Buffer overflow in url_filename function for wget 1.8.1 allows attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long URL.

Two problems have been found in the wget package as distributed in Debian GNU/Linux :

  - Stefano Zacchiroli found a buffer overrun in the     url_filename function, which would make wget segfault on     very long URLs
  - Steven M. Christey discovered that wget did not verify     the FTP server response to a NLST command: it must not     contain any directory information, since that can be     used to make an FTP client overwrite arbitrary files.

Both problems have been fixed in version 1.5.3-3.1 for Debian GNU/Linux 2.2/potato and version 1.8.1-6.1 for Debian GNU/Linux 3.0/woody.

The remote host is using a version of wget that contains a bug that may allow a rogue FTP site being mirrored to delete arbitrary files on this host.

Updated wget packages that correct a buffer overrun are now available.

GNU Wget is a file-retrieval utility that uses the HTTP and FTP protocols.

A buffer overflow in the url_filename function for wget 1.8.1 allows attackers to cause a segmentation fault via a long URL. Red Hat does not believe that this issue is exploitable to allow an attacker to be able to run arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2002-1565 to this issue.

Users of wget should install the erratum package, which contains a backported security patch and is not vulnerable to this issue.

ID	Name	Product	Family	Severity
15046	Debian DSA-209-1 : wget - directory traversal	Nessus	Debian Local Security Checks	high
1744	Wget < 1.8.3 Rogue FTP Site File Deletion	Nessus Network Monitor	Web Clients	medium
12436	RHEL 2.1 : wget (RHSA-2003:372)	Nessus	Red Hat Local Security Checks	high
800983	Wget < 1.8.3 Rogue FTP Site File Deletion	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2002-1565

critical

Tenable Plugins

high

medium

high

high