Critical Vulnerability in wget: Memory Corruption Risk Due to Improper Chunk Length Handling
Summary
ALPINE-CVE-2017-13090: The retr.c:fd_read_body() function is called when processing OK responses. Affects wget versions < 1.19.2-r0. Fixed in 1.19.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
wget is a widely used command-line utility for downloading files from the web. It supports HTTP, HTTPS, and FTP protocols, allowing users to retrieve content from various sources. The tool is known for its robustness and versatility, making it a staple in many development and operational environments. However, a vulnerability has been identified in versions prior to 1.19.2, which can lead to severe security risks if not addressed.
Vulnerability Detail
The vulnerability arises from the retr.c:fd_read_body() function, which processes OK responses in wget. When responses are sent in a chunked format, the chunk parser uses strtol() to read the length of each chunk but fails to verify that the length is non-negative. This oversight allows an attacker to manipulate the chunk length, resulting in a negative value being passed to the fd_read() function. Since fd_read() accepts an int argument, the high 32 bits of the negative chunk length are discarded, leading to an attacker-controlled length argument. This can corrupt malloc metadata, potentially allowing for arbitrary code execution or denial of service.
How To Fix
Minimum fixed version
1.19.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade wgetTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to wget or using alternative tools for downloading files until the vulnerability can be addressed. Additionally, ensure that your network security measures are in place to mitigate potential exploitation.
Conclusion
In summary, the vulnerability in wget poses a significant risk due to improper handling of chunk lengths, which can lead to memory corruption. It is crucial to update to the patched version to mitigate this risk. Users should also consider using tools like Vulert for ongoing monitoring of vulnerabilities in their software.
See every vulnerability recorded for wget →
FAQ
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to memory corruption, which may allow attackers to execute arbitrary code or cause a denial of service.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If you cannot update wget, consider using alternative tools for downloading files and ensure your network security measures are robust to prevent exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for wget.
