Synopsis

Moderate: w3m security update

Type/Severity

Security Advisory: Moderate

Topic

Updated w3m packages that fix one security issue are now available for Red
Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

The w3m program is a pager (or text file viewer) that can also be used as a
text mode web browser.

It was discovered that w3m is affected by the previously published "null
prefix attack", caused by incorrect handling of NULL characters in X.509
certificates. If an attacker is able to get a carefully-crafted certificate
signed by a trusted Certificate Authority, the attacker could use the
certificate during a man-in-the-middle attack and potentially confuse w3m
into accepting it by mistake. (CVE-2010-2074)

All w3m users should upgrade to these updated packages, which contain a
backported patch to correct this issue.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 604855 - CVE-2010-2074 w3m: doesn't handle NULL in Common Name properly

CVEs

• CVE-2010-2074

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 5

SRPM
w3m-0.5.1-17.el5_5.src.rpm	SHA-256: 41beafcfbd47f141cd9dd3d526f937a767019b77a39fdbc0b9d1c1b6d598344a
x86_64
w3m-0.5.1-17.el5_5.x86_64.rpm	SHA-256: 33a20a9729e61aaf080140dac2a3787e81ee0d486c6a371f555685afc1792a20
w3m-img-0.5.1-17.el5_5.x86_64.rpm	SHA-256: 8534b93961a2bc54cd434c66164f6aab81292c8f115bc0a46ff2ee86b1403de1
ia64
w3m-0.5.1-17.el5_5.ia64.rpm	SHA-256: 8a2aa26defa429190a2d4b966f3fd5895405992c9df4094efdf94134ed9033cb
w3m-img-0.5.1-17.el5_5.ia64.rpm	SHA-256: 56fc38761734626909ece3dcf93b22800108d391ffbece17ed41858793d6ae4c
i386
w3m-0.5.1-17.el5_5.i386.rpm	SHA-256: 34de733d67651ecb19e0b57e23f1c190a283c32a9a19353e4a02535f2d6f0027
w3m-img-0.5.1-17.el5_5.i386.rpm	SHA-256: 1fa20e3609f7cb242a75e75e077f8fc777671641964e19a3895c3a3753401be5

Red Hat Enterprise Linux Workstation 5

SRPM
w3m-0.5.1-17.el5_5.src.rpm	SHA-256: 41beafcfbd47f141cd9dd3d526f937a767019b77a39fdbc0b9d1c1b6d598344a
x86_64
w3m-0.5.1-17.el5_5.x86_64.rpm	SHA-256: 33a20a9729e61aaf080140dac2a3787e81ee0d486c6a371f555685afc1792a20
w3m-img-0.5.1-17.el5_5.x86_64.rpm	SHA-256: 8534b93961a2bc54cd434c66164f6aab81292c8f115bc0a46ff2ee86b1403de1
i386
w3m-0.5.1-17.el5_5.i386.rpm	SHA-256: 34de733d67651ecb19e0b57e23f1c190a283c32a9a19353e4a02535f2d6f0027
w3m-img-0.5.1-17.el5_5.i386.rpm	SHA-256: 1fa20e3609f7cb242a75e75e077f8fc777671641964e19a3895c3a3753401be5

Red Hat Enterprise Linux Desktop 5

SRPM
w3m-0.5.1-17.el5_5.src.rpm	SHA-256: 41beafcfbd47f141cd9dd3d526f937a767019b77a39fdbc0b9d1c1b6d598344a
x86_64
w3m-0.5.1-17.el5_5.x86_64.rpm	SHA-256: 33a20a9729e61aaf080140dac2a3787e81ee0d486c6a371f555685afc1792a20
w3m-img-0.5.1-17.el5_5.x86_64.rpm	SHA-256: 8534b93961a2bc54cd434c66164f6aab81292c8f115bc0a46ff2ee86b1403de1
i386
w3m-0.5.1-17.el5_5.i386.rpm	SHA-256: 34de733d67651ecb19e0b57e23f1c190a283c32a9a19353e4a02535f2d6f0027
w3m-img-0.5.1-17.el5_5.i386.rpm	SHA-256: 1fa20e3609f7cb242a75e75e077f8fc777671641964e19a3895c3a3753401be5

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
w3m-0.5.1-17.el5_5.src.rpm	SHA-256: 41beafcfbd47f141cd9dd3d526f937a767019b77a39fdbc0b9d1c1b6d598344a
s390x
w3m-0.5.1-17.el5_5.s390x.rpm	SHA-256: da58c5e412ed507ad49ec4fb39391d515f5c7dec681c4fedc1e8f1bdd2659b90
w3m-img-0.5.1-17.el5_5.s390x.rpm	SHA-256: 01b90871a7d28b7495acf3912a5f35a051cbe6803fbfc7e64e4e4bbbc624a84f

Red Hat Enterprise Linux for Power, big endian 5

SRPM
w3m-0.5.1-17.el5_5.src.rpm	SHA-256: 41beafcfbd47f141cd9dd3d526f937a767019b77a39fdbc0b9d1c1b6d598344a
ppc
w3m-0.5.1-17.el5_5.ppc.rpm	SHA-256: efd1489838c38951c6ab935096741d8cf0610ef44d3897006f205d27c8c7fe1b
w3m-img-0.5.1-17.el5_5.ppc.rpm	SHA-256: c456c202d3a9248ceb8046e143bf136486c41498b602e07d62ee36d67593e2d4

Red Hat Enterprise Linux Server from RHUI 5

SRPM
w3m-0.5.1-17.el5_5.src.rpm	SHA-256: 41beafcfbd47f141cd9dd3d526f937a767019b77a39fdbc0b9d1c1b6d598344a
x86_64
w3m-0.5.1-17.el5_5.x86_64.rpm	SHA-256: 33a20a9729e61aaf080140dac2a3787e81ee0d486c6a371f555685afc1792a20
w3m-img-0.5.1-17.el5_5.x86_64.rpm	SHA-256: 8534b93961a2bc54cd434c66164f6aab81292c8f115bc0a46ff2ee86b1403de1
i386
w3m-0.5.1-17.el5_5.i386.rpm	SHA-256: 34de733d67651ecb19e0b57e23f1c190a283c32a9a19353e4a02535f2d6f0027
w3m-img-0.5.1-17.el5_5.i386.rpm	SHA-256: 1fa20e3609f7cb242a75e75e077f8fc777671641964e19a3895c3a3753401be5