Untrusted search path vulnerability in the add_filename_to_string function in intl/gettext/loadmsgcat.c for Elinks 0.11.1 allows local users to cause Elinks to use an untrusted gettext message catalog (.po file) in a "../po" directory, which can be leveraged to conduct format string attacks.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix #235411 - CVE-2007-2027 - elinks tries to load .po     files from non-absolute path

  - fix #523258 - CVE-2008-7224 - entity_cache static array     buffer overflow

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2009-1471 advisory.

    - fix #235411 - CVE-2007-2027 - elinks tries to load .po files       from non-absolute path

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2007-2027 elinks tries to load .po files from a non-absolute path

CVE-2008-7224 elinks: entity_cache static array buffer overflow (off-by-one)

An off-by-one buffer overflow flaw was discovered in the way ELinks handled its internal cache of string representations for HTML special entities. A remote attacker could use this flaw to create a specially crafted HTML file that would cause ELinks to crash or, possibly, execute arbitrary code when rendered. (CVE-2008-7224)

It was discovered that ELinks tried to load translation files using relative paths. A local attacker able to trick a victim into running ELinks in a folder containing specially crafted translation files could use this flaw to confuse the victim via incorrect translations, or cause ELinks to crash and possibly execute arbitrary code via embedded formatting sequences in translated messages. (CVE-2007-2027)

An updated elinks package that fixes two security issues is now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

ELinks is a text-based Web browser. ELinks does not display any images, but it does support frames, tables, and most other HTML tags.

An off-by-one buffer overflow flaw was discovered in the way ELinks handled its internal cache of string representations for HTML special entities. A remote attacker could use this flaw to create a specially crafted HTML file that would cause ELinks to crash or, possibly, execute arbitrary code when rendered. (CVE-2008-7224)

It was discovered that ELinks tried to load translation files using relative paths. A local attacker able to trick a victim into running ELinks in a folder containing specially crafted translation files could use this flaw to confuse the victim via incorrect translations, or cause ELinks to crash and possibly execute arbitrary code via embedded formatting sequences in translated messages. (CVE-2007-2027)

All ELinks users are advised to upgrade to this updated package, which contains backported patches to resolve these issues.

Arnaud Giersch discovered that elinks incorrectly attempted to load gettext catalogs from a relative path. If a user were tricked into running elinks from a specific directory, a local attacker could execute code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200706-03 (ELinks: User-assisted execution of arbitrary code)

    Arnaud Giersch discovered that the 'add_filename_to_string()' function     in file intl/gettext/loadmsgcat.c uses an untrusted relative path,     allowing for a format string attack with a malicious .po file.
  Impact :

    A local attacker could entice a user to run ELinks in a specially     crafted directory environment containing a malicious '.po' file,     possibly resulting in the execution of arbitrary code with the     privileges of the user running ELinks.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
79468	OracleVM 2.1 : elinks (OVMSA-2009-0030)	Nessus	OracleVM Local Security Checks	high
67934	Oracle Linux 5 : elinks (ELSA-2009-1471)	Nessus	Oracle Linux Local Security Checks	critical
60673	Scientific Linux Security Update : elinks on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
43798	CentOS 4 / 5 : elinks (CESA-2009:1471)	Nessus	CentOS Local Security Checks	high
41962	RHEL 4 / 5 : elinks (RHSA-2009:1471)	Nessus	Red Hat Local Security Checks	high
28055	Ubuntu 6.06 LTS / 6.10 / 7.04 : elinks vulnerability (USN-457-1)	Nessus	Ubuntu Local Security Checks	medium
25453	GLSA-200706-03 : ELinks: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2007-2027

critical

Tenable Plugins

high

critical

high

high

high

medium

medium