ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.

From Red Hat Security Advisory 2007:0933 :

An updated ELinks package that corrects a security vulnerability is now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ELinks is a text mode Web browser used from the command line that supports rendering modern web pages.

An information disclosure flaw was found in the way ELinks passes https POST data to a proxy server. POST data sent via a proxy to an https site is not properly encrypted by ELinks, possibly allowing the disclosure of sensitive information. (CVE-2007-5034)

All users of Elinks are advised to upgrade to this updated package, which contains a backported patch that resolves this issue.

Details :

An information disclosure flaw was found in the way ELinks passes https POST data to a proxy server. POST data sent via a proxy to an https site is not properly encrypted by ELinks, possibly allowing the disclosure of sensitive information. (CVE-2007-5034)

Kalle Olavi Niemitalo discovered that if elinks makes a POST request to an HTTPS URL through a proxy, information may be sent in clear-text between elinks and the proxy. Attackers with access to the network could steal sensitive information (such as passwords).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update done because of security issue in elinks 0.11.2 , in this update are included other changes done in devel branch meanwhile(license tags,open macro,license file missing,duplicate buildrequires).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated ELinks package that corrects a security vulnerability is now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ELinks is a text mode Web browser used from the command line that supports rendering modern web pages.

An information disclosure flaw was found in the way ELinks passes https POST data to a proxy server. POST data sent via a proxy to an https site is not properly encrypted by ELinks, possibly allowing the disclosure of sensitive information. (CVE-2007-5034)

All users of Elinks are advised to upgrade to this updated package, which contains a backported patch that resolves this issue.

Jump to new upstream version because of security issue #297991/done some other changes already committed to devel

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Kalle Olavi Niemitalo discovered that elinks, an advanced text-mode WWW browser, sent HTTP POST data in cleartext when using an HTTPS proxy server potentially allowing private information to be disclosed.

ID	Name	Product	Family	Severity
67576	Oracle Linux 4 / 5 : elinks (ELSA-2007-0933)	Nessus	Oracle Linux Local Security Checks	medium
60259	Scientific Linux Security Update : elinks on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
28124	Ubuntu 6.06 LTS / 6.10 / 7.04 : elinks vulnerability (USN-519-1)	Nessus	Ubuntu Local Security Checks	medium
27761	Fedora 7 : elinks-0.11.3-1.fc7 (2007-2224)	Nessus	Fedora Local Security Checks	medium
26954	RHEL 4 / 5 : elinks (RHSA-2007:0933)	Nessus	Red Hat Local Security Checks	medium
26932	Fedora Core 6 : elinks-0.11.3-1.fc6 (2007-710)	Nessus	Fedora Local Security Checks	medium
26929	CentOS 4 / 5 : elinks (CESA-2007:0933)	Nessus	CentOS Local Security Checks	medium
26210	Debian DSA-1380-1 : elinks - programming error	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2007-5034

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium