GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2009-420:01 advisory.

    GNU Wget is a file retrieval utility which can use either the HTTP or FTP protocols. Wget features include     the ability to work in the background while you are logged out, recursive retrieval of directories, file     name wildcard matching, remote file timestamp storage and comparison, use of Rest with FTP servers and     Range with HTTP servers to retrieve files over slow or unstable connections, support for Proxy servers,     and configurability.
    Security bugs fixed with this release:
    CVE-2009-3490     GNU Wget before 1.12 does not properly handle a '0' character in a domain name in the Common Name field of     an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a     crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

SunOS 5.10_x86: wget patch.
Date this patch was last updated by Sun : Oct/14/19

SunOS 5.10: wget patch.
Date this patch was last updated by Sun : Oct/14/19

SunOS 5.10_x86: wget patch.
Date this patch was last updated by Sun : Sep/15/16

SunOS 5.10_x86: wget patch.
Date this patch was last updated by Sun : Jan/19/15

SunOS 5.10_x86: wget patch.
Date this patch was last updated by Sun : Apr/15/11

SunOS 5.10: wget patch.
Date this patch was last updated by Sun : Sep/15/16

SunOS 5.10: wget patch.
Date this patch was last updated by Sun : Jan/19/15

SunOS 5.10: wget patch.
Date this patch was last updated by Sun : Apr/15/11

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2009-1549 advisory.

    [1.11.4-3]
    - add fix for CVE-2009-3490,       incorrect verification of SSL certificate with NUL in name

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An updated wget package that fixes a security issue is now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GNU Wget is a file retrieval utility that can use HTTP, HTTPS, and FTP.

Daniel Stenberg reported that Wget is affected by the previously published 'null prefix attack', caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse Wget into accepting it by mistake. (CVE-2009-3490)

Wget users should upgrade to this updated package, which contains a backported patch to correct this issue.

CVE-2009-3490 wget: incorrect verification of SSL certificate with NUL in name

Daniel Stenberg reported that Wget is affected by the previously published 'null prefix attack', caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse Wget into accepting it by mistake. (CVE-2009-3490)

Daniel Stenberg discovered that wget, a network utility to retrieve files from the Web using HTTP(S) and FTP, is vulnerable to the 'Null Prefix Attacks Against SSL/TLS Certificates' published at the Blackhat conference some time ago. This allows an attacker to perform undetected man-in-the-middle attacks via a crafted ITU-T X.509 certificate with an injected null byte in the Common Name field.

- Wed Nov 18 2009 Karsten Hopp <karsten at redhat.com>     1.12-2

    - don't provide /usr/share/info/dir

    - Tue Nov 17 2009 Karsten Hopp <karsten at redhat.com>       1.12-1

    - update to wget-1.12

    - fixes CVE-2009-3490 wget: incorrect verification of       SSL certificate with NUL in name

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Nov 18 2009 Karsten Hopp <karsten at redhat.com>     1.12-2

    - don't provide /usr/share/info/dir

    - Tue Nov 17 2009 Karsten Hopp <karsten at redhat.com>       1.12-1

    - update to wget-1.12

    - fixes CVE-2009-3490 wget: incorrect verification of       SSL certificate with NUL in name

  - Fri Aug 21 2009 Tomas Mraz <tmraz at redhat.com> -     1.11.4-5

    - rebuilt with new openssl

    - Mon Jul 27 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.11.4-4

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Nov 18 2009 Karsten Hopp <karsten at redhat.com>     1.12-2

    - don't provide /usr/share/info/dir

    - Tue Nov 17 2009 Karsten Hopp <karsten at redhat.com>       1.12-1

    - update to wget-1.12

    - fixes CVE-2009-3490 wget: incorrect verification of       SSL certificate with NUL in name

  - Fri Aug 21 2009 Tomas Mraz <tmraz at redhat.com> -     1.11.4-5

    - rebuilt with new openssl

    - Mon Jul 27 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.11.4-4

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

    - Wed Feb 25 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.11.4-3

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Sun Jan 18 2009 Tomas Mraz <tmraz at redhat.com>       1.11.4-2

    - rebuild with new openssl

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 / 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2009:1549 advisory.

  - wget: incorrect verification of SSL certificate with NUL in name (CVE-2009-3490)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is using a version of Wget earlier than 1.12.  Such versions are potentially affected by a security bypass vulnerability because the application fails to properly handle Common Name fields n X.509 certificates that contain an ASCII NULL character.

The remote host is affected by the vulnerability described in GLSA-200910-01 (Wget: Certificate validation error)

    The vendor reported that Wget does not properly handle Common Name (CN)     fields in X.509 certificates that contain an ASCII NUL (\\0) character.
    Specifically, the processing of such fields is stopped at the first     occurrence of a NUL character. This type of vulnerability was recently     discovered by Dan Kaminsky and Moxie Marlinspike.
  Impact :

    A remote attacker might employ a specially crafted X.509 certificate,     containing a NUL character in the Common Name field to conduct     man-in-the-middle attacks on SSL connections made using Wget.
  Workaround :

    There is no known workaround at this time.

It was discovered that Wget did not correctly handle SSL certificates with zero bytes in the Common Name. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been found and corrected in wget :

GNU Wget before 1.12 does not properly handle a '&#0;' (NUL) character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408 (CVE-2009-3490).

This update provides a solution to this vulnerability.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

ID	Name	Product	Family	Type	Severity
291426	MiracleLinux 3 : wget-1.11.4-2.1.1AXS3 (AXSA:2009-420:01)	Nessus	Miracle Linux Local Security Checks	Local	critical
129875	Solaris 10 (x86) : 125216-08	Nessus	Solaris Local Security Checks	Local	medium
129871	Solaris 10 (sparc) : 125215-08	Nessus	Solaris Local Security Checks	Local	medium
107924	Solaris 10 (x86) : 125216-07	Nessus	Solaris Local Security Checks	Local	medium
107923	Solaris 10 (x86) : 125216-05	Nessus	Solaris Local Security Checks	Local	medium
107922	Solaris 10 (x86) : 125216-04	Nessus	Solaris Local Security Checks	Local	medium
107422	Solaris 10 (sparc) : 125215-07	Nessus	Solaris Local Security Checks	Local	medium
107421	Solaris 10 (sparc) : 125215-05	Nessus	Solaris Local Security Checks	Local	medium
107420	Solaris 10 (sparc) : 125215-04	Nessus	Solaris Local Security Checks	Local	medium
67954	Oracle Linux 5 : wget (ELSA-2009-1549)	Nessus	Oracle Linux Local Security Checks	Local	critical
67069	CentOS 3 / 4 / 5 : wget (CESA-2009:1549)	Nessus	CentOS Local Security Checks	Local	medium
60690	Scientific Linux Security Update : wget on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	Local	medium
44769	Debian DSA-1904-1 : wget - insufficient input validation	Nessus	Debian Local Security Checks	Local	medium
42988	Fedora 12 : wget-1.12-2.fc12 (2009-11836)	Nessus	Fedora Local Security Checks	Local	medium
42987	Fedora 11 : wget-1.12-2.fc11 (2009-11740)	Nessus	Fedora Local Security Checks	Local	medium
42986	Fedora 10 : wget-1.12-2.fc10 (2009-11739)	Nessus	Fedora Local Security Checks	Local	medium
42359	RHEL 4 / 5 : wget (RHSA-2009:1549)	Nessus	Red Hat Local Security Checks	Local	critical
5212	GNU Wget SSL Certificate Security Bypass	Nessus Network Monitor	Web Clients		medium
42197	GLSA-200910-01 : Wget: Certificate validation error	Nessus	Gentoo Local Security Checks	Local	medium
42050	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : wget vulnerability (USN-842-1)	Nessus	Ubuntu Local Security Checks	Local	medium
40638	Mandriva Linux Security Advisory : wget (MDVSA-2009:206-1)	Nessus	Mandriva Local Security Checks	Local	medium

Detections

Analytics

CVE-2009-3490

critical

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium