CVE-2012-5821 Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to i...
MediumCVSS 5.9
EPSS 0.81%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lynx | All versions | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 11.10 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 12.10 | No fix listed |
References
- www.cs.utexas.edu exploit
- MDVSA-2013:101 broken-link vendor-advisory
- USN-1642-1 third-party-advisory vendor-advisory
- lynx-ssl-spoofing(79930) third-party-advisory vdb-entry
- wiki.mageia.org third-party-advisory