It was discovered that wget, a command line tool for downloading files from the WWW, uses server-provided file names when creating local files. This may lead to code execution in some scenarios.

After this update, wget will ignore server-provided file names. You can restore the old behavior in cases where it is not desirable by invoking wget with the new --use-server-file-name option.

It was discovered that Wget would use filenames provided by the server when following 3xx redirects. If a user or automated system were tricked into downloading a file from a malicious site, a remote attacker could create the file with an arbitrary name (e.g. .wgetrc), and possibly run arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

SunOS 5.10: wget patch.
Date this patch was last updated by Sun : Apr/15/11

SunOS 5.10_x86: wget patch.
Date this patch was last updated by Sun : Apr/15/11

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2014-4877 wget: FTP symlink arbitrary filesystem     access (#1156133)

  - Fix the parsing of weblink when doing recursive     retrieving (#960137)

  - Fix errors found by static analysis of source code     (#873216)

  - Add SNI (Server Name Indication) support (#909604)

  - Add --trust-server-names option to fix CVE-2010-2252     (#1062190)

  - Fix wget to recognize certificates with alternative     names (#736445)

From Red Hat Security Advisory 2014:0151 :

An updated wget package that fixes one security issue and one bug is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The wget package provides the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Wget provides various useful features, such as the ability to work in the background while the user is logged out, recursive retrieval of directories, file name wildcard matching or updating files in dependency on file timestamp comparison.

It was discovered that wget used a file name provided by the server when saving a downloaded file. This could cause wget to create a file with a different name than expected, possibly allowing the server to execute arbitrary code on the client. (CVE-2010-2252)

Note: With this update, wget always uses the last component of the original URL as the name for the downloaded file. Previous behavior of using the server provided name or the last component of the redirected URL when creating files can be re-enabled by using the '--trust-server-names' command line option, or by setting 'trust_server_names=on' in the wget start-up file.

This update also fixes the following bugs :

* Prior to this update, the wget package did not recognize HTTPS SSL certificates with alternative names (subjectAltName) specified in the certificate as valid. As a consequence, running the wget command failed with a certificate error. This update fixes wget to recognize such certificates as valid. (BZ#1060113)

All users of wget are advised to upgrade to this updated package, which contain backported patches to correct these issues.

An updated wget package that fixes one security issue and one bug is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The wget package provides the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Wget provides various useful features, such as the ability to work in the background while the user is logged out, recursive retrieval of directories, file name wildcard matching or updating files in dependency on file timestamp comparison.

It was discovered that wget used a file name provided by the server when saving a downloaded file. This could cause wget to create a file with a different name than expected, possibly allowing the server to execute arbitrary code on the client. (CVE-2010-2252)

Note: With this update, wget always uses the last component of the original URL as the name for the downloaded file. Previous behavior of using the server provided name or the last component of the redirected URL when creating files can be re-enabled by using the '--trust-server-names' command line option, or by setting 'trust_server_names=on' in the wget start-up file.

This update also fixes the following bugs :

* Prior to this update, the wget package did not recognize HTTPS SSL certificates with alternative names (subjectAltName) specified in the certificate as valid. As a consequence, running the wget command failed with a certificate error. This update fixes wget to recognize such certificates as valid. (BZ#1060113)

All users of wget are advised to upgrade to this updated package, which contain backported patches to correct these issues.

A vulnerability has been found and corrected in wget :

GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory (CVE-2010-2252).

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct this issue.

It was discovered that wget used a file name provided by the server when saving a downloaded file. This could cause wget to create a file with a different name than expected, possibly allowing the server to execute arbitrary code on the client. (CVE-2010-2252)

Note: With this update, wget always uses the last component of the original URL as the name for the downloaded file. Previous behavior of using the server provided name or the last component of the redirected URL when creating files can be re-enabled by using the '--trust-server-names' command line option, or by setting 'trust_server_names=on' in the wget start-up file.

This update also fixes the following bugs :

  - Prior to this update, the wget package did not recognize     HTTPS SSL certificates with alternative names     (subjectAltName) specified in the certificate as valid.
    As a consequence, running the wget command failed with a     certificate error. This update fixes wget to recognize     such certificates as valid.

The remote host is affected by the vulnerability described in GLSA-201110-10 (Wget: User-assisted file creation or overwrite)

    It was discovered that Wget was unsafely trusting server-provided       filenames. This allowed attackers to overwrite or create files on the       user's system by sending a redirect from the expected URL to another URL       specifying the targeted file.
  Impact :

    An unauthenticated remote attacker may be able to create or overwrite       local files by enticing the user to open an attacker controlled URL,       possibly leading to execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

GNU Wget version 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.

ID	Name	Product	Family	Published	Updated	Severity
48256	Debian DSA-2088-1 : wget - missing input sanitization	Nessus	Debian Local Security Checks	8/6/2010	1/4/2021	medium
49102	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : wget vulnerability (USN-982-1)	Nessus	Ubuntu Local Security Checks	9/3/2010	9/19/2019	medium
107420	Solaris 10 (sparc) : 125215-04	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	medium
107922	Solaris 10 (x86) : 125216-04	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	medium
79551	OracleVM 3.3 : wget (OVMSA-2014-0036)	Nessus	OracleVM Local Security Checks	11/26/2014	1/4/2021	high
72419	Oracle Linux 6 : wget (ELSA-2014-0151)	Nessus	Oracle Linux Local Security Checks	2/11/2014	1/14/2021	medium
72436	CentOS 6 : wget (CESA-2014:0151)	Nessus	CentOS Local Security Checks	2/12/2014	1/4/2021	medium
49100	Mandriva Linux Security Advisory : wget (MDVSA-2010:170)	Nessus	Mandriva Local Security Checks	9/3/2010	1/6/2021	medium
72420	RHEL 6 : wget (RHSA-2014:0151)	Nessus	Red Hat Local Security Checks	2/11/2014	1/14/2021	medium
72421	Scientific Linux Security Update : wget on SL6.x i386/x86_64 (20140210)	Nessus	Scientific Linux Local Security Checks	2/11/2014	1/14/2021	medium
56503	GLSA-201110-10 : Wget: User-assisted file creation or overwrite	Nessus	Gentoo Local Security Checks	10/14/2011	1/6/2021	medium
49109	FreeBSD : wget -- multiple HTTP client download filename vulnerability (d754b7d2-b6a7-11df-826c-e464a695cb21)	Nessus	FreeBSD Local Security Checks	9/4/2010	1/6/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium