Red Hat Security Advisory 2014-0151-01 - The wget package provides the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Wget provides various useful features, such as the ability to work in the background while the user is logged out, recursive retrieval of directories, file name wildcard matching or updating files in dependency on file timestamp comparison. It was discovered that wget used a file name provided by the server when saving a downloaded file. This could cause wget to create a file with a different name than expected, possibly allowing the server to execute arbitrary code on the client.
717dbc82ea79c91d9538b6f147db7b2dd6acd325272744b0caa4401f82b731caGentoo Linux Security Advisory 201110-10 - Insecure usage of server provided filenames may allow the creation or overwriting of local files when using wget. Versions less than 1.12-r2 are affected.
57dae58b35db5d84d829246ae2e2948d8086cfde9ce02247b86fb1f06da2ba7eMandriva Linux Security Advisory 2010-170 - GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a.wgetrc filename followed by a 3xx redirect to a URL with a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
7e88aed1075989ac769d24f2faa6e97354507085f73aec9d9b3c569aa00eb29cUbuntu Security Notice 982-1 - It was discovered that Wget would use filenames provided by the server when following 3xx redirects. If a user or automated system were tricked into downloading a file from a malicious site, a remote attacker could create the file with an arbitrary name (e.g. .wgetrc), and possibly run arbitrary code.
be7c4fe29817c72f9305a6d624c17041f6d9550cee4300c4b5f9e9f8162ce554Debian Linux Security Advisory 2088-1 - It was discovered that wget, a command line tool for downloading files from the WWW, uses server-provided file names when creating local files. This may lead to code execution in some scenarios.
f2965cab14d4c005e6ced247c1b2fa71227caae9d016b3197226d34ffd158fb4
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed