GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wget: FTP symlink arbitrary filesystem access (CVE-2014-4877)

  - wget: Lack of filename checking allows arbitrary file upload via FTP redirect (CVE-2016-4971)

  - GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the     destination filename of a download, which allows remote servers to create or overwrite arbitrary files via     a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted     filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home     directory. (CVE-2010-2252)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 3 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - wget: multiple HTTP client download filename vulnerability [OCERT 2010-001] (CVE-2010-2252)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - wget: multiple HTTP client download filename vulnerability [OCERT 2010-001] (CVE-2010-2252)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

SunOS 5.10_x86: wget patch.
Date this patch was last updated by Sun : Apr/15/11

SunOS 5.10: wget patch.
Date this patch was last updated by Sun : Apr/15/11

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2014-4877 wget: FTP symlink arbitrary filesystem     access (#1156133)

  - Fix the parsing of weblink when doing recursive     retrieving (#960137)

  - Fix errors found by static analysis of source code     (#873216)

  - Add SNI (Server Name Indication) support (#909604)

  - Add --trust-server-names option to fix CVE-2010-2252     (#1062190)

  - Fix wget to recognize certificates with alternative     names (#736445)

An updated wget package that fixes one security issue and one bug is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The wget package provides the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Wget provides various useful features, such as the ability to work in the background while the user is logged out, recursive retrieval of directories, file name wildcard matching or updating files in dependency on file timestamp comparison.

It was discovered that wget used a file name provided by the server when saving a downloaded file. This could cause wget to create a file with a different name than expected, possibly allowing the server to execute arbitrary code on the client. (CVE-2010-2252)

Note: With this update, wget always uses the last component of the original URL as the name for the downloaded file. Previous behavior of using the server provided name or the last component of the redirected URL when creating files can be re-enabled by using the '--trust-server-names' command line option, or by setting 'trust_server_names=on' in the wget start-up file.

This update also fixes the following bugs :

* Prior to this update, the wget package did not recognize HTTPS SSL certificates with alternative names (subjectAltName) specified in the certificate as valid. As a consequence, running the wget command failed with a certificate error. This update fixes wget to recognize such certificates as valid. (BZ#1060113)

All users of wget are advised to upgrade to this updated package, which contain backported patches to correct these issues.

It was discovered that wget used a file name provided by the server when saving a downloaded file. This could cause wget to create a file with a different name than expected, possibly allowing the server to execute arbitrary code on the client. (CVE-2010-2252)

Note: With this update, wget always uses the last component of the original URL as the name for the downloaded file. Previous behavior of using the server provided name or the last component of the redirected URL when creating files can be re-enabled by using the '--trust-server-names' command line option, or by setting 'trust_server_names=on' in the wget start-up file.

This update also fixes the following bugs :

  - Prior to this update, the wget package did not recognize     HTTPS SSL certificates with alternative names     (subjectAltName) specified in the certificate as valid.
    As a consequence, running the wget command failed with a     certificate error. This update fixes wget to recognize     such certificates as valid.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2014-0151 advisory.

    - Add --trust-server-names option to fix CVE-2010-2252 (#833831)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201110-10 (Wget: User-assisted file creation or overwrite)

    It was discovered that Wget was unsafely trusting server-provided       filenames. This allowed attackers to overwrite or create files on the       user's system by sending a redirect from the expected URL to another URL       specifying the targeted file.
  Impact :

    An unauthenticated remote attacker may be able to create or overwrite       local files by enticing the user to open an attacker controlled URL,       possibly leading to execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

GNU Wget version 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.

It was discovered that Wget would use filenames provided by the server when following 3xx redirects. If a user or automated system were tricked into downloading a file from a malicious site, a remote attacker could create the file with an arbitrary name (e.g. .wgetrc), and possibly run arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been found and corrected in wget :

GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory (CVE-2010-2252).

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct this issue.

It was discovered that wget, a command line tool for downloading files from the WWW, uses server-provided file names when creating local files. This may lead to code execution in some scenarios.

After this update, wget will ignore server-provided file names. You can restore the old behavior in cases where it is not desirable by invoking wget with the new --use-server-file-name option.

ID	Name	Product	Family	Severity
198391	RHEL 5 : wget (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198389	RHEL 3 : wget (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198351	RHEL 4 : wget (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
107922	Solaris 10 (x86) : 125216-04	Nessus	Solaris Local Security Checks	medium
107420	Solaris 10 (sparc) : 125215-04	Nessus	Solaris Local Security Checks	medium
79551	OracleVM 3.3 : wget (OVMSA-2014-0036)	Nessus	OracleVM Local Security Checks	high
72436	CentOS 6 : wget (CESA-2014:0151)	Nessus	CentOS Local Security Checks	medium
72421	Scientific Linux Security Update : wget on SL6.x i386/x86_64 (20140210)	Nessus	Scientific Linux Local Security Checks	medium
72420	RHEL 6 : wget (RHSA-2014:0151)	Nessus	Red Hat Local Security Checks	medium
72419	Oracle Linux 6 : wget (ELSA-2014-0151)	Nessus	Oracle Linux Local Security Checks	high
56503	GLSA-201110-10 : Wget: User-assisted file creation or overwrite	Nessus	Gentoo Local Security Checks	medium
49109	FreeBSD : wget -- multiple HTTP client download filename vulnerability (d754b7d2-b6a7-11df-826c-e464a695cb21)	Nessus	FreeBSD Local Security Checks	medium
49102	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : wget vulnerability (USN-982-1)	Nessus	Ubuntu Local Security Checks	medium
49100	Mandriva Linux Security Advisory : wget (MDVSA-2010:170)	Nessus	Mandriva Local Security Checks	medium
48256	Debian DSA-2088-1 : wget - missing input sanitization	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2010-2252

critical

Tenable Plugins

high

high

high

medium

medium

high

medium

medium

medium

high

medium

medium

medium

medium

medium