Directory traversal vulnerability in wget before 1.8.2-4 allows a remote FTP server to create or overwrite files as the wget user via filenames containing (1) /absolute/path or (2) .. (dot dot) sequences.

Two problems have been found in the wget package as distributed in Debian GNU/Linux :

  - Stefano Zacchiroli found a buffer overrun in the     url_filename function, which would make wget segfault on     very long URLs
  - Steven M. Christey discovered that wget did not verify     the FTP server response to a NLST command: it must not     contain any directory information, since that can be     used to make an FTP client overwrite arbitrary files.

Both problems have been fixed in version 1.5.3-3.1 for Debian GNU/Linux 2.2/potato and version 1.8.1-6.1 for Debian GNU/Linux 3.0/woody.

The remote host is using a version of wget that contains a bug that may allow a rogue FTP site being mirrored to delete arbitrary files on this host.

A vulnerability in all versions of wget prior to and including 1.8.2 was discovered by Steven M. Christey. The bug permits a malicious FTP server to create or overwriet files anywhere on the local file system by sending filenames beginning with '/' or containing '/../'. This can be used to make vulnerable FTP clients write files that can later be used for attack against the client machine.

The wget packages shipped with Red Hat Linux Advanced Server 2.1 contain a security bug which, under certain circumstances, can cause local files to be written outside the download directory.

[Updated 09 Jan 2003] Added fixed packages for the Itanium (IA64) architecture.

[Updated 06 Feb 2003] Added fixed packages for Advanced Workstation 2.1

Versions of wget prior to 1.8.2-4 contain a bug that permits a malicious FTP server to create or overwrite files anywhere on the local file system.

FTP clients must check to see if an FTP server's response to the NLST command includes any directory information along with the list of filenames required by the FTP protocol (RFC 959, section 4.1.3).

If the FTP client fails to do so, a malicious FTP server can send filenames beginning with '/' or containing '/../' which can be used to direct a vulnerable FTP client to write files (such as .forward, .rhosts, .shost, etc.) that can then be used for later attacks against the client machine.

All users of wget should upgrade to the errata packages which are not vulnerable to this issue.

Thanks to Steven M. Christey for his work in discovering this issue in current FTP clients and for providing a patched FTP server to verify the new packages.

ID	Name	Product	Family	Severity
15046	Debian DSA-209-1 : wget - directory traversal	Nessus	Debian Local Security Checks	high
1744	Wget < 1.8.3 Rogue FTP Site File Deletion	Nessus Network Monitor	Web Clients	medium
13984	Mandrake Linux Security Advisory : wget (MDKSA-2002:086)	Nessus	Mandriva Local Security Checks	medium
12334	RHEL 2.1 : wget (RHSA-2002:256)	Nessus	Red Hat Local Security Checks	medium
800983	Wget < 1.8.3 Rogue FTP Site File Deletion	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2002-1344

high

Tenable Plugins

high

medium

medium

medium

high