Lucene search

K
archlinuxArchLinuxASA-201710-34
HistoryOct 29, 2017 - 12:00 a.m.

[ASA-201710-34] wget: multiple issues

2017-10-2900:00:00
security.archlinux.org
11

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.645 Medium

EPSS

Percentile

97.8%

Arch Linux Security Advisory ASA-201710-34

Severity: Critical
Date : 2017-10-29
CVE-ID : CVE-2017-13089 CVE-2017-13090 CVE-2017-6508
Package : wget
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-473

Summary

The package wget before version 1.19.2-1 is vulnerable to multiple
issues including arbitrary code execution and content spoofing.

Resolution

Upgrade to 1.19.2-1.

pacman -Syu “wget>=1.19.2-1”

The problems have been fixed upstream in version 1.19.2.

Workaround

None.

Description

  • CVE-2017-13089 (arbitrary code execution)

A stack-based buffer overflow has been found in the HTTP protocol
handling code of wget < 1.19.2, when processing chunked, encoded HTTP
responses. By tricking an unsuspecting user into connecting to a
malicious HTTP server, an attacker could exploit this flaw to
potentially execute arbitrary code.

  • CVE-2017-13090 (arbitrary code execution)

A heap-based buffer overflow has been found in the HTTP protocol
handling code of wget < 1.19.2, when processing chunked encoded HTTP
responses. By tricking an unsuspecting user into connecting to a
malicious HTTP server, an attacker could exploit this flaw to
potentially execute arbitrary code.

  • CVE-2017-6508 (content spoofing)

A CRLF injection flaw was found in the way wget < 1.19.2 handled URLs.
A remote attacker could use this flaw to inject arbitrary HTTP headers
in requests, via CRLF sequences in the host sub-component of a URL, by
tricking a user running wget into processing crafted URLs.

Impact

By tricking an unsuspecting user into connecting to a malicious host a
remote attacker is able to execute arbitrary code or spoof returned
data.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1505444
https://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734ea5125770989c215df3f
https://bugzilla.redhat.com/show_bug.cgi?id=1505445
https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ba6b44f6745b14dce414761a8e4b35d31b176bba
http://lists.gnu.org/archive/html/bug-wget/2017-03/msg00018.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-6508
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=4d729e322fae359a1aefaafec1144764a54e8ad4
https://security.archlinux.org/CVE-2017-13089
https://security.archlinux.org/CVE-2017-13090
https://security.archlinux.org/CVE-2017-6508

OSVersionArchitecturePackageVersionFilename
ArchLinuxanyanywget< 1.19.2-1UNKNOWN

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.645 Medium

EPSS

Percentile

97.8%