Description
The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials through GSSAPI, which allows remote servers to authenticate as the client via the delegated credentials.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:075 ↗
- http://www.securityfocus.com/bid/57065 ↗
- http://www.debian.org/security/2012/dsa-2592 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80882 ↗
- http://repo.or.cz/w/elinks.git/blobdiff/89056e21fc7ab8e1c2d4e06ec9d0c6d01e70669a..da18694ff7dd0b67dfcb3c417fb0579b1e7d02d7:/src/protocol/http/http_negotiate.c ↗
- http://rhn.redhat.com/errata/RHSA-2013-0250.html ↗
- http://bugzilla.elinks.cz/show_bug.cgi?id=1124 ↗
- http://secunia.com/advisories/51569 ↗