Format string vulnerability in the inputAnswer function in file.c in w3m before 0.5.2, when run with the dump or backend option, allows remote attackers to execute arbitrary code via format string specifiers in the Common Name (CN) field of an SSL certificate associated with an https URL.

A format string problem in w3m -dump / -backend mode could be used by a malicious server to crash w3m or execute code. (CVE-2006-6772)

A format string vulnerability was discovered in w3m. If a user were tricked into visiting an HTTPS URL protected by a specially crafted SSL certificate, an attacker could execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200701-06 (w3m: Format string vulnerability)

    w3m in -dump or -backend mode does not correctly handle printf() format     string specifiers in the Common Name (CN) field of an X.509 SSL     certificate.
  Impact :

    An attacker could entice a user to visit a malicious website that would     load a specially crafted X.509 SSL certificate containing '%n' or other     format string specifiers, possibly resulting in the execution of     arbitrary code with the rights of the user running w3m.
  Workaround :

    There is no known workaround at this time.

- Resolves: rh#221484: CVE-2006-6772 w3m is vulnerable to     format string attack via CN field of SSL/TLS certificate     when invoked with -dump/-backend

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Resolves: rh#221484

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An anonymous person reports :

w3m-0.5.1 crashes when using the -dump or -backend options to open a HTTPS URL with a SSL certificate where the CN contains '%n%n%n%n%n%n'.

ID	Name	Product	Family	Severity
41111	SuSE9 Security Update : w3m (YOU Patch Number 11376)	Nessus	SuSE Local Security Checks	high
29594	SuSE 10 Security Update : w3m (ZYPP Patch Number 2439)	Nessus	SuSE Local Security Checks	high
27987	Ubuntu 5.10 / 6.06 LTS / 6.10 : w3m vulnerabilities (USN-399-1)	Nessus	Ubuntu Local Security Checks	high
27475	openSUSE 10 Security Update : w3m (w3m-2433)	Nessus	SuSE Local Security Checks	high
24204	GLSA-200701-06 : w3m: Format string vulnerability	Nessus	Gentoo Local Security Checks	high
24200	Fedora Core 5 : w3m-0.5.1-15.fc5 (2007-078)	Nessus	Fedora Local Security Checks	high
24199	Fedora Core 6 : w3m-0.5.1-15.fc6 (2007-077)	Nessus	Fedora Local Security Checks	high
23989	FreeBSD : w3m -- format string vulnerability (9347d82d-9a66-11db-b271-000e35248ad7)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2006-6772

critical

Tenable Plugins

high

high

high

high

high

high

high

high