istream.c in w3m 0.5.2 and possibly other versions, when ssl_verify_server is enabled, does not properly handle a '\0' character in a domain name in the (1) subject's Common Name or (2) Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

This update for w3m fixes the following issues :

  - update to debian git version (bsc#1011293) addressed     security issues: CVE-2016-9621: w3m:
    global-buffer-overflow write (bsc#1012020)     CVE-2016-9622: w3m: null deref (bsc#1012021)     CVE-2016-9623: w3m: null deref (bsc#1012022)     CVE-2016-9624: w3m: near-null deref (bsc#1012023)     CVE-2016-9625: w3m: stack overflow (bsc#1012024)     CVE-2016-9626: w3m: stack overflow (bsc#1012025)     CVE-2016-9627: w3m: heap overflow read + deref     (bsc#1012026) CVE-2016-9628: w3m: null deref     (bsc#1012027) CVE-2016-9629: w3m: null deref     (bsc#1012028) CVE-2016-9630: w3m: global-buffer-overflow     read (bsc#1012029) CVE-2016-9631: w3m: null deref     (bsc#1012030) CVE-2016-9632: w3m: global-buffer-overflow     read (bsc#1012031) CVE-2016-9633: w3m: OOM (bsc#1012032)     CVE-2016-9434: w3m: null deref (bsc#1011283)     CVE-2016-9435: w3m: use uninit value (bsc#1011284)     CVE-2016-9436: w3m: use uninit value (bsc#1011285)     CVE-2016-9437: w3m: write to rodata (bsc#1011286)     CVE-2016-9438: w3m: null deref (bsc#1011287)     CVE-2016-9439: w3m: stack overflow (bsc#1011288)     CVE-2016-9440: w3m: near-null deref (bsc#1011289)     CVE-2016-9441: w3m: near-null deref (bsc#1011290)     CVE-2016-9442: w3m: potential heap buffer corruption     (bsc#1011291) CVE-2016-9443: w3m: null deref     (bsc#1011292)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2010-0565 advisory.

    [0.5.1-17]
    - Resolves:rh#604861:Clear execstack requirement also for ia64 architecture

    [0.5.1-16]
    - Resolves:rh#604861:CVE-2010-2074 w3m: doesn't handle NULL in Common Name properly

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201210-01 (w3m: SSL spoofing vulnerability)

    A SSL spoofing vulnerability has been discovered in w3m. Please review       the CVE identifier referenced below for details.
  Impact :

    A remote attacker might employ a specially crafted certificate to       conduct man-in-the-middle attacks on SSL connections made using w3m.
  Workaround :

    There is no known workaround at this time.

It was discovered that w3m is affected by the previously published 'null prefix attack', caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse w3m into accepting it by mistake. (CVE-2010-2074)

w3m does not handle embedded NUL characters in the common name and in subject alternative names of X.509 certificates (CVE-2010-2074). This update fixes the issue and also turns on verification of x509 certificates by default which was not the case before.

Ludwig Nussel discovered w3m does not properly handle SSL/TLS certificates with NULL characters in the certificate name. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications.
(CVE-2010-2074).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated w3m packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The w3m program is a pager (or text file viewer) that can also be used as a text mode web browser.

It was discovered that w3m is affected by the previously published 'null prefix attack', caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse w3m into accepting it by mistake. (CVE-2010-2074)

All w3m users should upgrade to these updated packages, which contain a backported patch to correct this issue.

w3m did not handle embedded nul characters in the common name and in subject alternative names of x509 certificates. CVE-2010-2074 has been assigned to this issue. This update also turns on verification of x509 certificates by default which was not the case before.

Resolves:rh#604864-CVE-2010-2074 w3m: doesn't handle NULL in Common Name properly

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
95625	SUSE SLES11 Security Update : w3m (SUSE-SU-2016:3046-1)	Nessus	SuSE Local Security Checks	high
68072	Oracle Linux 5 : w3m (ELSA-2010-0565)	Nessus	Oracle Linux Local Security Checks	medium
62631	GLSA-201210-01 : w3m: SSL spoofing vulnerability	Nessus	Gentoo Local Security Checks	medium
60823	Scientific Linux Security Update : w3m on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
50965	SuSE 11 / 11.1 Security Update : w3m (SAT Patch Numbers 2560 / 2563)	Nessus	SuSE Local Security Checks	medium
49931	SuSE 10 Security Update : w3m (ZYPP Patch Number 7076)	Nessus	SuSE Local Security Checks	medium
48283	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : w3m vulnerability (USN-967-1)	Nessus	Ubuntu Local Security Checks	medium
47886	RHEL 5 : w3m (RHSA-2010:0565)	Nessus	Red Hat Local Security Checks	medium
47867	CentOS 5 : w3m (CESA-2010:0565)	Nessus	CentOS Local Security Checks	medium
47777	openSUSE Security Update : w3m (openSUSE-SU-2010:0393-1)	Nessus	SuSE Local Security Checks	medium
47775	openSUSE Security Update : w3m (openSUSE-SU-2010:0393-1)	Nessus	SuSE Local Security Checks	medium
47773	openSUSE Security Update : w3m (openSUSE-SU-2010:0393-1)	Nessus	SuSE Local Security Checks	medium
47768	Fedora 12 : w3m-0.5.2-17.fc12 (2010-10369)	Nessus	Fedora Local Security Checks	medium
47684	Fedora 13 : w3m-0.5.2-18.fc13 (2010-10250)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2010-2074

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium