The remote host is affected by the vulnerability described in GLSA-201210-01 (w3m: SSL spoofing vulnerability)

    A SSL spoofing vulnerability has been discovered in w3m. Please review       the CVE identifier referenced below for details.
  Impact :

    A remote attacker might employ a specially crafted certificate to       conduct man-in-the-middle attacks on SSL connections made using w3m.
  Workaround :

    There is no known workaround at this time.

This update for w3m fixes the following issues :

  - update to debian git version (bsc#1011293) addressed     security issues: CVE-2016-9621: w3m:
    global-buffer-overflow write (bsc#1012020)     CVE-2016-9622: w3m: null deref (bsc#1012021)     CVE-2016-9623: w3m: null deref (bsc#1012022)     CVE-2016-9624: w3m: near-null deref (bsc#1012023)     CVE-2016-9625: w3m: stack overflow (bsc#1012024)     CVE-2016-9626: w3m: stack overflow (bsc#1012025)     CVE-2016-9627: w3m: heap overflow read + deref     (bsc#1012026) CVE-2016-9628: w3m: null deref     (bsc#1012027) CVE-2016-9629: w3m: null deref     (bsc#1012028) CVE-2016-9630: w3m: global-buffer-overflow     read (bsc#1012029) CVE-2016-9631: w3m: null deref     (bsc#1012030) CVE-2016-9632: w3m: global-buffer-overflow     read (bsc#1012031) CVE-2016-9633: w3m: OOM (bsc#1012032)     CVE-2016-9434: w3m: null deref (bsc#1011283)     CVE-2016-9435: w3m: use uninit value (bsc#1011284)     CVE-2016-9436: w3m: use uninit value (bsc#1011285)     CVE-2016-9437: w3m: write to rodata (bsc#1011286)     CVE-2016-9438: w3m: null deref (bsc#1011287)     CVE-2016-9439: w3m: stack overflow (bsc#1011288)     CVE-2016-9440: w3m: near-null deref (bsc#1011289)     CVE-2016-9441: w3m: near-null deref (bsc#1011290)     CVE-2016-9442: w3m: potential heap buffer corruption     (bsc#1011291) CVE-2016-9443: w3m: null deref     (bsc#1011292)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

w3m does not handle embedded NUL characters in the common name and in subject alternative names of X.509 certificates (CVE-2010-2074). This update fixes the issue and also turns on verification of x509 certificates by default which was not the case before.

Resolves:rh#604864-CVE-2010-2074 w3m: doesn't handle NULL in Common Name properly

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

w3m did not handle embedded nul characters in the common name and in subject alternative names of x509 certificates. CVE-2010-2074 has been assigned to this issue. This update also turns on verification of x509 certificates by default which was not the case before.

It was discovered that w3m is affected by the previously published 'null prefix attack', caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse w3m into accepting it by mistake. (CVE-2010-2074)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2010-0565 advisory.

    [0.5.1-17]
    - Resolves:rh#604861:Clear execstack requirement also for ia64 architecture

    [0.5.1-16]
    - Resolves:rh#604861:CVE-2010-2074 w3m: doesn't handle NULL in Common Name properly

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated w3m packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The w3m program is a pager (or text file viewer) that can also be used as a text mode web browser.

It was discovered that w3m is affected by the previously published 'null prefix attack', caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse w3m into accepting it by mistake. (CVE-2010-2074)

All w3m users should upgrade to these updated packages, which contain a backported patch to correct this issue.

Ludwig Nussel discovered w3m does not properly handle SSL/TLS certificates with NULL characters in the certificate name. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications.
(CVE-2010-2074).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
62631	GLSA-201210-01 : w3m: SSL spoofing vulnerability	Nessus	Gentoo Local Security Checks	10/19/2012	1/6/2021	medium
95625	SUSE SLES11 Security Update : w3m (SUSE-SU-2016:3046-1)	Nessus	SuSE Local Security Checks	12/8/2016	1/19/2021	high
50965	SuSE 11 / 11.1 Security Update : w3m (SAT Patch Numbers 2560 / 2563)	Nessus	SuSE Local Security Checks	12/2/2010	1/14/2021	medium
47684	Fedora 13 : w3m-0.5.2-18.fc13 (2010-10250)	Nessus	Fedora Local Security Checks	7/9/2010	1/11/2021	medium
47775	openSUSE Security Update : w3m (openSUSE-SU-2010:0393-1)	Nessus	SuSE Local Security Checks	7/21/2010	1/14/2021	medium
47773	openSUSE Security Update : w3m (openSUSE-SU-2010:0393-1)	Nessus	SuSE Local Security Checks	7/21/2010	1/14/2021	medium
49931	SuSE 10 Security Update : w3m (ZYPP Patch Number 7076)	Nessus	SuSE Local Security Checks	10/11/2010	1/14/2021	medium
47768	Fedora 12 : w3m-0.5.2-17.fc12 (2010-10369)	Nessus	Fedora Local Security Checks	7/21/2010	1/11/2021	medium
60823	Scientific Linux Security Update : w3m on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
68072	Oracle Linux 5 : w3m (ELSA-2010-0565)	Nessus	Oracle Linux Local Security Checks	7/12/2013	10/22/2024	medium
47886	RHEL 5 : w3m (RHSA-2010:0565)	Nessus	Red Hat Local Security Checks	7/28/2010	1/14/2021	medium
48283	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : w3m vulnerability (USN-967-1)	Nessus	Ubuntu Local Security Checks	8/10/2010	9/19/2019	medium
47777	openSUSE Security Update : w3m (openSUSE-SU-2010:0393-1)	Nessus	SuSE Local Security Checks	7/21/2010	1/14/2021	medium
47867	CentOS 5 : w3m (CESA-2010:0565)	Nessus	CentOS Local Security Checks	7/28/2010	1/4/2021	medium

Detections

Analytics

Plugins Search

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium