CVE-2012-5821
published 2012-11-04CVE-2012-5821: Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL…
PriorityP423medium5.9CVSS 3.1
AVNACHPRNUINSUCNIHAN
EPSS
0.81%
53.4th percentile
Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
vendor_ubuntu6.8MEDIUM
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-px54-5fmq-rf2f: Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof S
ghsa_unreviewed·2022-05-17
CVE-2012-5821 [MEDIUM] CWE-295 GHSA-px54-5fmq-rf2f: Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof S
Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function.
Ubuntu
Lynx vulnerabilities
vendor_ubuntu·2012-11-29·CVSS 6.8
CVE-2010-2810 [MEDIUM] Lynx vulnerabilities
Title: Lynx vulnerabilities
Summary: Two security issues were fixed in Lynx.
Dan Rosenberg discovered a heap-based buffer overflow in Lynx. If a user
were tricked into opening a specially crafted page, a remote attacker could
cause a denial of service via application crash, or possibly execute
arbitrary code as the user invoking the program. This issue only affected
Ubuntu 10.04 LTS. (CVE-2010-2810)
It was discovered that Lynx did not properly verify that an HTTPS
certificate was signed by a trusted certificate authority. This could allow
an attacker to perform a "machine-in-the-middle" (MITM) attack which would make
the user believe their connection is secure, but is actually being
monitored. This update changes the behavior of Lynx such that self-signed
certificates no longer validate
Red Hat
lynx: Does not verify that the server's certificate is signed by a trusted certification authority
vendor_redhat·2012-10-16·CVSS 5.9
CVE-2012-5821 [MEDIUM] lynx: Does not verify that the server's certificate is signed by a trusted certification authority
lynx: Does not verify that the server's certificate is signed by a trusted certification authority
Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function.
Statement: Not vulnerable. This issue did not affect the versions of lynx as shipped with Red Hat Enterprise Linux 5 and 6 as they were not build against GnuTLS.
Package: lynx (Red Hat Enterprise Linux 5) - Not affected
Package: lynx (Red Hat Enterprise Linux 6) - Not affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-5821 lynx: Does not verify that the server's certificate is signed by a trusted certification authority [fedora-all]
bugzilla·2012-11-05·CVSS 5.9
CVE-2012-5821 [MEDIUM] CVE-2012-5821 lynx: Does not verify that the server's certificate is signed by a trusted certification authority [fedora-all]
CVE-2012-5821 lynx: Does not verify that the server's certificate is signed by a trusted certification authority [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes fi
Bugzilla
CVE-2012-5821 lynx: Does not verify that the server's certificate is signed by a trusted certification authority
bugzilla·2012-11-05·CVSS 5.9
CVE-2012-5821 [MEDIUM] CVE-2012-5821 lynx: Does not verify that the server's certificate is signed by a trusted certification authority
CVE-2012-5821 lynx: Does not verify that the server's certificate is signed by a trusted certification authority
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-5821 to the following vulnerability:
Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function.
References:
[1] http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
[2] https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html
[3] http://www.sigsac.org/ccs/CCS2012/techprogram.shtml
Discussion:
Created lynx tracking bugs for this issue
Affects: fedora-all [bug 873278]
---
We build lynx against OpenSSL, not GnuTLS. So
CWE
Improper Following of a Certificate's Chain of Trust
mitre_cwe
CWE-296 Improper Following of a Certificate's Chain of Trust
CWE-296: Improper Following of a Certificate's Chain of Trust
The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.
If a system does not follow the chain of trust of a certificate to a root server, the certificate loses all usefulness as a metric of trust. Essentially, the trust gained from a certificate is derived from a chain of trust -- with a reputable trusted entity at the end of that list. The end user must trust that reputable source, and this reputable source must vouch for the resource in question through the medium of the certificate. In some cases, this trust traverses several entities who vouch for one another. The enti
CWE
Improper Certificate Validation
mitre_cwe
CWE-295 Improper Certificate Validation
CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Background: A certificate is a token that associates an identity (principal) to a cryptographic key. Certificates can be used to check if a public key belongs to the assumed owner.
Modes of Introduction:
Phase: Architecture and Design
Phase: Implementation
Note: REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Phase: Implementation
Note: When the product uses certificate pinning, the developer might not properly validate all relevant components of the certificate before pinning the certificate. This can make it difficult or expensive to test after the pinning is complete.
Common Consequences:
Scope: Integrity, Authentication. Im
http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdfhttp://www.mandriva.com/security/advisories?name=MDVSA-2013:101http://www.ubuntu.com/usn/USN-1642-1https://exchange.xforce.ibmcloud.com/vulnerabilities/79930https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0351http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdfhttp://www.mandriva.com/security/advisories?name=MDVSA-2013:101http://www.ubuntu.com/usn/USN-1642-1https://exchange.xforce.ibmcloud.com/vulnerabilities/79930https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0351
2012-11-04
Published