Wget vulnerability

2010-09-0200:00:00

ubuntu.com

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

6.6 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.3%

JSON

Releases

Ubuntu 10.04
Ubuntu 9.10
Ubuntu 9.04
Ubuntu 8.04
Ubuntu 6.06

Packages

wget -

Details

It was discovered that Wget would use filenames provided by the server when
following 3xx redirects. If a user or automated system were tricked into
downloading a file from a malicious site, a remote attacker could create
the file with an arbitrary name (e.g. .wgetrc), and possibly run arbitrary
code.

OSVersionArchitecturePackageVersionFilename
Ubuntu9.10noarchwget< 1.11.4-2ubuntu2.1UNKNOWN
Ubuntu9.10noarchwget-udeb< 1.11.4-2ubuntu2.1UNKNOWN
Ubuntu9.04noarchwget< 1.11.4-2ubuntu1.2UNKNOWN
Ubuntu9.04noarchwget-udeb< 1.11.4-2ubuntu1.2UNKNOWN
Ubuntu8.04noarchwget< 1.10.2-3ubuntu1.2UNKNOWN
Ubuntu8.04noarchwget-udeb< 1.10.2-3ubuntu1.2UNKNOWN
Ubuntu6.06noarchwget< 1.10.2-1ubuntu1.2UNKNOWN
Ubuntu10.04noarchwget< 1.12-1.1ubuntu2.1UNKNOWN
Ubuntu10.04noarchwget-udeb< 1.12-1.1ubuntu2.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	9.10	noarch	wget	< 1.11.4-2ubuntu2.1	UNKNOWN
Ubuntu	9.10	noarch	wget-udeb	< 1.11.4-2ubuntu2.1	UNKNOWN
Ubuntu	9.04	noarch	wget	< 1.11.4-2ubuntu1.2	UNKNOWN
Ubuntu	9.04	noarch	wget-udeb	< 1.11.4-2ubuntu1.2	UNKNOWN
Ubuntu	8.04	noarch	wget	< 1.10.2-3ubuntu1.2	UNKNOWN
Ubuntu	8.04	noarch	wget-udeb	< 1.10.2-3ubuntu1.2	UNKNOWN
Ubuntu	6.06	noarch	wget	< 1.10.2-1ubuntu1.2	UNKNOWN
Ubuntu	10.04	noarch	wget	< 1.12-1.1ubuntu2.1	UNKNOWN
Ubuntu	10.04	noarch	wget-udeb	< 1.12-1.1ubuntu2.1	UNKNOWN