Vulnerability in wget - security update
Summary
DLA-536-1: wget - security update. Affects wget versions < 1.13.4-3+deb7u3. Fixed in 1.13.4-3+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
wget is a command-line utility for retrieving files from the web using various protocols, including HTTP and FTP. It is commonly used to download files and web pages. The vulnerability in wget version 1.13.4-3+deb7u3 and earlier versions allows an attacker to manipulate the destination filename when redirecting from HTTP to FTP resources. This could lead to the execution of arbitrary code or the overwrite of unintended files on the user's system.
Vulnerability Detail
The vulnerability arises from wget's trust in the HTTP server during a redirect from HTTP to FTP. Instead of using the original name as the destination filename, wget would trust the HTTP server and use the name in the redirected URL. This behavior was changed in version 1.13.4-3+deb7u3, and now wget works similarly to a redirect from HTTP to another HTTP resource, using the original name as the destination file. To maintain the previous behavior, the user must provide the --trust-server-names option.
How To Fix
Minimum fixed version
1.13.4-3+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade wgetTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the wget package is not immediately possible, a workaround is to explicitly provide the --trust-server-names option when using wget. This ensures that the original name is used as the destination file, even during redirects from HTTP to FTP resources.
Conclusion
In conclusion, the vulnerability in wget version 1.13.4-3+deb7u3 and earlier versions allows an attacker to manipulate the destination filename during redirects from HTTP to FTP resources. To mitigate this vulnerability, it is recommended to upgrade the wget package to version 1.13.4-3+deb7u3 or later. Alternatively, the --trust-server-names option can be used as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for wget →
FAQ
Wget is a command-line utility for retrieving files from the web using various protocols, including HTTP and FTP. It is commonly used to download files and web pages.
This vulnerability allows an attacker to manipulate the destination filename when redirecting from HTTP to FTP resources. This could lead to the execution of arbitrary code or the overwrite of unintended files on the user's system.
To fix this vulnerability, it is recommended to upgrade the wget package to version 1.13.4-3+deb7u3 or later. This can be done by running the package manager update command specific to your operating system.
Yes, a workaround is to explicitly provide the --trust-server-names option when using wget. This ensures that the original name is used as the destination file, even during redirects from HTTP to FTP resources.
More information about Debian LTS security advisories, including how to apply updates and frequently asked questions, can be found at: https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for wget.
