Buffer overflow in entity_cache in ELinks before 0.11.4rc0 allows remote attackers to cause a denial of service (crash) via a crafted link.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix #235411 - CVE-2007-2027 - elinks tries to load .po     files from non-absolute path

  - fix #523258 - CVE-2008-7224 - entity_cache static array     buffer overflow

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2009-1471 advisory.

    - fix #235411 - CVE-2007-2027 - elinks tries to load .po files       from non-absolute path

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2007-2027 elinks tries to load .po files from a non-absolute path

CVE-2008-7224 elinks: entity_cache static array buffer overflow (off-by-one)

An off-by-one buffer overflow flaw was discovered in the way ELinks handled its internal cache of string representations for HTML special entities. A remote attacker could use this flaw to create a specially crafted HTML file that would cause ELinks to crash or, possibly, execute arbitrary code when rendered. (CVE-2008-7224)

It was discovered that ELinks tried to load translation files using relative paths. A local attacker able to trick a victim into running ELinks in a folder containing specially crafted translation files could use this flaw to confuse the victim via incorrect translations, or cause ELinks to crash and possibly execute arbitrary code via embedded formatting sequences in translated messages. (CVE-2007-2027)

Jakub Wilk discovered an off-by-one buffer overflow in the charset handling of elinks, a feature-rich text-mode WWW browser, which might lead to the execution of arbitrary code if the user is tricked into opening a malformed HTML page.

An updated elinks package that fixes two security issues is now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

ELinks is a text-based Web browser. ELinks does not display any images, but it does support frames, tables, and most other HTML tags.

An off-by-one buffer overflow flaw was discovered in the way ELinks handled its internal cache of string representations for HTML special entities. A remote attacker could use this flaw to create a specially crafted HTML file that would cause ELinks to crash or, possibly, execute arbitrary code when rendered. (CVE-2008-7224)

It was discovered that ELinks tried to load translation files using relative paths. A local attacker able to trick a victim into running ELinks in a folder containing specially crafted translation files could use this flaw to confuse the victim via incorrect translations, or cause ELinks to crash and possibly execute arbitrary code via embedded formatting sequences in translated messages. (CVE-2007-2027)

All ELinks users are advised to upgrade to this updated package, which contains backported patches to resolve these issues.

SecurityFocus reports :

ELinks is prone to an off-by-one buffer-overflow vulnerability because the application fails to accurately reference the last element of a buffer.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Teemu Salmela discovered that Elinks did not properly validate input when processing smb:// URLs. If a user were tricked into viewing a malicious website and had smbclient installed, a remote attacker could execute arbitrary code with the privileges of the user invoking the program. (CVE-2006-5925)

Jakub Wilk discovered a logic error in Elinks, leading to a buffer overflow. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-7224).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
79468	OracleVM 2.1 : elinks (OVMSA-2009-0030)	Nessus	OracleVM Local Security Checks	high
67934	Oracle Linux 5 : elinks (ELSA-2009-1471)	Nessus	Oracle Linux Local Security Checks	critical
60673	Scientific Linux Security Update : elinks on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
44767	Debian DSA-1902-1 : elinks - buffer overflow	Nessus	Debian Local Security Checks	high
43798	CentOS 4 / 5 : elinks (CESA-2009:1471)	Nessus	CentOS Local Security Checks	high
42238	FreeBSD : elinks -- buffer overflow vulnerability (2544f543-c178-11de-b175-001cc0377035)	Nessus	FreeBSD Local Security Checks	high
42208	Ubuntu 6.06 LTS : elinks vulnerabilities (USN-851-1)	Nessus	Ubuntu Local Security Checks	high
41962	RHEL 4 / 5 : elinks (RHSA-2009:1471)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2008-7224

critical

Tenable Plugins

high

critical

high

high

high

high

high

high