GLSA-201110-10 : Wget: User-assisted file creation or overwrite
Medium Nessus Plugin ID 56503
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-201110-10 (Wget: User-assisted file creation or overwrite)
It was discovered that Wget was unsafely trusting server-provided filenames. This allowed attackers to overwrite or create files on the user's system by sending a redirect from the expected URL to another URL specifying the targeted file.
An unauthenticated remote attacker may be able to create or overwrite local files by enticing the user to open an attacker controlled URL, possibly leading to execution of arbitrary code.
There is no known workaround at this time.
SolutionAll Wget users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=net-misc/wget-1.12-r2' NOTE: This is a legacy GLSA. Updates for all affected architectures are available since September 19, 2010. It is likely that your system is already no longer affected by this issue.