The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials through GSSAPI, which allows remote servers to authenticate as the client via the delegated credentials.

The remote Oracle Linux 5 / 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2013-0250 advisory.

    [0.12-0.21.pre5]
    - do not delegate GSSAPI credentials (CVE-2012-4545)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated elinks package fixes security vulnerability :

Marko Myllynen discovered that ELinks, a powerful text-mode browser, incorrectly delegates user credentials during GSS-Negotiate (CVE-2012-4545).

It was found that ELinks performed client credentials delegation during the client-to-server GSS security mechanisms negotiation. A rogue server could use this flaw to obtain the client's credentials and impersonate that client to other servers that are using GSSAPI.
(CVE-2012-4545)

An updated elinks package that fixes one security issue is now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

ELinks is a text-based web browser. ELinks does not display any images, but it does support frames, tables, and most other HTML tags.

It was found that ELinks performed client credentials delegation during the client-to-server GSS security mechanisms negotiation. A rogue server could use this flaw to obtain the client's credentials and impersonate that client to other servers that are using GSSAPI.
(CVE-2012-4545)

This issue was discovered by Marko Myllynen of Red Hat.

All ELinks users are advised to upgrade to this updated package, which contains a backported patch to resolve the issue.

- do not delegate GSSAPI credentials (CVE-2012-4545)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Marko Myllynen discovered that ELinks, a powerful text-mode browser, incorrectly delegates user credentials during GSS-Negotiate.

ID	Name	Product	Family	Severity
68729	Oracle Linux 5 / 6 : elinks (ELSA-2013-0250)	Nessus	Oracle Linux Local Security Checks	critical
66089	Mandriva Linux Security Advisory : elinks (MDVSA-2013:075)	Nessus	Mandriva Local Security Checks	medium
64566	Scientific Linux Security Update : elinks on SL5.x, SL6.x i386/x86_64 (20130211)	Nessus	Scientific Linux Local Security Checks	medium
64565	RHEL 5 / 6 : elinks (RHSA-2013:0250)	Nessus	Red Hat Local Security Checks	medium
64562	CentOS 5 / 6 : elinks (CESA-2013:0250)	Nessus	CentOS Local Security Checks	medium
63516	Fedora 17 : elinks-0.12-0.29.pre5.fc17 (2013-0265)	Nessus	Fedora Local Security Checks	medium
63515	Fedora 18 : elinks-0.12-0.32.pre5.fc18 (2013-0207)	Nessus	Fedora Local Security Checks	medium
63342	Debian DSA-2592-1 : elinks - programming error	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-4545

critical

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium