Debian has issued an update for elinks. This fixes a weakness, which can be exploited by malicious people to conduct spoofing attacks.

The weakness is caused due to the HTTP Negotiate or GSS-Negotiate feature unconditionally performing credential delegation, which allows a server to obtain the client's security credentials. This can be exploited by a malicious server to impersonate the client to any other server using the same GSSAPI mechanism.

Successful exploitation requires tricking a user into connecting to a malicious server using the HTTP Negotiate or GSS-Negotiate feature.

Solution
Apply updated packages via the apt-get package manager.

Provided and/or discovered by
The vendor credits Marko Myllynen within a bug report.

Original Advisory
DSA-2592-1 :
http://www.debian.org/security/2012/dsa-2592

elinks:
http://bugzilla.elinks.cz/show_bug.cgi?id=1124

Deep Links
Links available to Secunia VIM customers