FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

wget -- multiple vulnerabilities

Affected packages
wget < 1.10.a1
wget-devel < 1.10.a1
0 <= wget+ipv6
0 <= wgetpro

Details

VuXML ID 06f142ff-4df3-11d9-a9e7-0001020eed82
Discovery 2004-12-09
Entry 2004-12-14
Modified 2005-04-15

Jan Minar reports that there exists multiple vulnerabilities in wget:

Wget erroneously thinks that the current directory is a fair game, and will happily write in any file in and below it. Malicious HTTP response or malicious HTML file can redirect wget to a file that is vital to the system, and wget will create/append/overwrite it.

Wget apparently has at least two methods of ``sanitizing'' the potentially malicious data it receives from the HTTP stream, therefore a malicious redirects can pass the check. We haven't find a way to trick wget into writing above the parent directory, which doesn't mean it's not possible.

Malicious HTTP response can overwrite parts of the terminal so that the user will not notice anything wrong, or will believe the error was not fatal.

References

Bugtraq ID 11871
CVE Name CVE-2004-1487
CVE Name CVE-2004-1488
Message 20041209091438.GA15010@kontryhel.haltyr.dyndns.org
URL http://bugs.debian.org/261755