The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.

According to the versions of the wget package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A stack-based buffer overflow when processing chunked,     encoded HTTP responses was found in wget. By tricking     an unsuspecting user into connecting to a malicious     HTTP server, an attacker could exploit this flaw to     potentially execute arbitrary code.(CVE-2017-13089)

  - A flaw was found in the way Wget handled symbolic     links. A malicious FTP server could allow Wget running     in the mirror mode (using the '-m' command line option)     to write an arbitrary file to a location writable to by     the user running Wget, possibly leading to code     execution.(CVE-2014-4877)

  - A cookie injection flaw was found in wget. An attacker     can create a malicious website which, when accessed,     overrides cookies belonging to arbitrary     domains.(CVE-2018-0494)

  - It was found that wget used a file name provided by the     server for the downloaded file when following a HTTP     redirect to a FTP server resource. This could cause     wget to create a file with a different name than     expected, possibly allowing the server to execute     arbitrary code on the client.(CVE-2016-4971)

  - A heap-based buffer overflow, when processing chunked     encoded HTTP responses, was found in wget. By tricking     an unsuspecting user into connecting to a malicious     HTTP server, an attacker could exploit this flaw to     potentially execute arbitrary code.(CVE-2017-13090)

  - Race condition in wget 1.17 and earlier, when used in     recursive or mirroring mode to download a single file,     might allow remote servers to bypass intended access     list restrictions by keeping an HTTP connection     open.(CVE-2016-7098)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the wget package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A cookie injection flaw was found in wget. An attacker     can create a malicious website which, when accessed,     overrides cookies belonging to arbitrary     domains.(CVE-2018-0494)

  - A stack-based buffer overflow when processing chunked,     encoded HTTP responses was found in wget. By tricking     an unsuspecting user into connecting to a malicious     HTTP server, an attacker could exploit this flaw to     potentially execute arbitrary code.(CVE-2017-13089)

  - A heap-based buffer overflow, when processing chunked     encoded HTTP responses, was found in wget. By tricking     an unsuspecting user into connecting to a malicious     HTTP server, an attacker could exploit this flaw to     potentially execute arbitrary code.(CVE-2017-13090)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the wget package has been released.

An update for wget is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols.

Security Fix(es) :

* A stack-based and a heap-based buffer overflow flaws were found in wget when processing chunked encoded HTTP responses. By tricking an unsuspecting user into connecting to a malicious HTTP server, an attacker could exploit these flaws to potentially execute arbitrary code. (CVE-2017-13089, CVE-2017-13090)

Red Hat would like to thank the GNU Wget project for reporting these issues.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

new upstream release with CVE fixes

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for wget fixes the following security issues :

  - CVE-2017-13089,CVE-2017-13090: Missing checks for     negative remaining_chunk_size in skip_short_body and     fd_read_body could cause stack-based buffer overflows,     which could have been exploited by malicious servers.
    (bsc#1064715,bsc#1064716)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201711-06 (GNU Wget: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wget. Please review the       referenced CVE identifiers for details.
  Impact :

    A remote attacker, by enticing a user to connect to a malicious server,       could remotely execute arbitrary code or cause a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

According to the versions of the wget package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A stack-based and a heap-based buffer overflow flaws     were found in wget when processing chunked encoded HTTP     responses. By tricking an unsuspecting user into     connecting to a malicious HTTP server, an attacker     could exploit these flaws to potentially execute     arbitrary code. (CVE-2017-13089, CVE-2017-13090)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for wget fixes the following security issues :

  - CVE-2017-13089,CVE-2017-13090: Missing checks for     negative remaining_chunk_size in skip_short_body and     fd_read_body could cause stack-based buffer overflows,     which could have been exploited by malicious servers.
    (bsc#1064715,bsc#1064716)

This update was imported from the SUSE:SLE-12:Update update project.

Antti Levomaki, Christian Jalio, Joonas Pihlaja :

Wget contains two vulnerabilities, a stack overflow and a heap overflow, in the handling of HTTP chunked encoding. By convincing a user to download a specific link over HTTP, an attacker may be able to execute arbitrary code with the privileges of the user.

Antti Levomaeki, Christian Jalio, Joonas Pihlaja and Juhani Eronen discovered two buffer overflows in the HTTP protocol handler of the Wget download tool, which could result in the execution of arbitrary code when connecting to a malicious HTTP server.

CVE-2017-13089 Fix stack overflow in HTTP protocol handling.

CVE-2017-13090 Fix heap overflow in HTTP protocol handling.

For Debian 7 'Wheezy', these problems have been fixed in version 1.13.4-3+deb7u5.

We recommend that you upgrade your wget packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for wget is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols.

Security Fix(es) :

* A stack-based and a heap-based buffer overflow flaws were found in wget when processing chunked encoded HTTP responses. By tricking an unsuspecting user into connecting to a malicious HTTP server, an attacker could exploit these flaws to potentially execute arbitrary code. (CVE-2017-13089, CVE-2017-13090)

Red Hat would like to thank the GNU Wget project for reporting these issues.

New wget packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3464-1 advisory.

    Antti Levomki, Christian Jalio, and Joonas Pihlaja discovered that Wget incorrectly handled certain HTTP     responses. A remote attacker could use this issue to cause Wget to crash, resulting in a denial of     service, or possibly execute arbitrary code. (CVE-2017-13089, CVE-2017-13090)

    Dawid Golunski discovered that Wget incorrectly handled recursive or mirroring mode. A remote attacker     could possibly use this issue to bypass intended access list restrictions. (CVE-2016-7098)

    Orange Tsai discovered that Wget incorrectly handled CRLF sequences in HTTP headers. A remote attacker     could possibly use this issue to inject arbitrary HTTP headers. (CVE-2017-6508)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - A stack-based and a heap-based buffer overflow flaws     were found in wget when processing chunked encoded HTTP     responses. By tricking an unsuspecting user into     connecting to a malicious HTTP server, an attacker could     exploit these flaws to potentially execute arbitrary     code. (CVE-2017-13089, CVE-2017-13090)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2017-3075 advisory.

    [1.14-15.1]
    - Fixed various security flaws (CVE-2017-13089, CVE-2017-13090)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Heap-based buffer overflow in HTTP protocol handling

A heap-based buffer overflow, when processing chunked encoded HTTP responses, was found in wget. By tricking an unsuspecting user into connecting to a malicious HTTP server, an attacker could exploit this flaw to potentially execute arbitrary code. (CVE-2017-13090)

Stack-based buffer overflow in HTTP protocol handling

A stack-based buffer overflow when processing chunked, encoded HTTP responses was found in wget. By tricking an unsuspecting user into connecting to a malicious HTTP server, an attacker could exploit this flaw to potentially execute arbitrary code. (CVE-2017-13089)

ID	Name	Product	Family	Severity
124920	EulerOS Virtualization 3.0.1.0 : wget (EulerOS-SA-2019-1417)	Nessus	Huawei Local Security Checks	high
124916	EulerOS Virtualization for ARM 64 3.0.1.0 : wget (EulerOS-SA-2019-1413)	Nessus	Huawei Local Security Checks	high
121766	Photon OS 1.0: Wget PHSA-2017-0047	Nessus	PhotonOS Local Security Checks	high
121765	Photon OS 2.0: Wget PHSA-2017-0046	Nessus	PhotonOS Local Security Checks	high
119236	Virtuozzo 7 : wget (VZLSA-2017-3075)	Nessus	Virtuozzo Local Security Checks	high
105816	Fedora 27 : wget (2017-10fbce01ec)	Nessus	Fedora Local Security Checks	high
104650	SUSE SLED12 / SLES12 Security Update : wget (SUSE-SU-2017:2871-2)	Nessus	SuSE Local Security Checks	high
104609	Fedora 25 : wget (2017-de8a421dcd)	Nessus	Fedora Local Security Checks	high
104514	GLSA-201711-06 : GNU Wget: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
104452	Fedora 26 : wget (2017-f0b3231763)	Nessus	Fedora Local Security Checks	high
104295	EulerOS 2.0 SP2 : wget (EulerOS-SA-2017-1270)	Nessus	Huawei Local Security Checks	high
104294	EulerOS 2.0 SP1 : wget (EulerOS-SA-2017-1269)	Nessus	Huawei Local Security Checks	high
104240	openSUSE Security Update : wget (openSUSE-2017-1210)	Nessus	SuSE Local Security Checks	high
104226	FreeBSD : wget -- Stack overflow in HTTP protocol handling (09849e71-bb12-11e7-8357-3065ec6f3643)	Nessus	FreeBSD Local Security Checks	high
104223	Debian DSA-4008-1 : wget - security update	Nessus	Debian Local Security Checks	high
104221	Debian DLA-1149-1 : wget security update	Nessus	Debian Local Security Checks	high
104218	CentOS 7 : wget (CESA-2017:3075)	Nessus	CentOS Local Security Checks	high
104216	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : wget (SSA:2017-300-02)	Nessus	Slackware Local Security Checks	high
104211	Ubuntu 14.04 LTS / 16.04 LTS : Wget vulnerabilities (USN-3464-1)	Nessus	Ubuntu Local Security Checks	high
104207	Scientific Linux Security Update : wget on SL7.x x86_64 (20171026)	Nessus	Scientific Linux Local Security Checks	high
104205	RHEL 7 : wget (RHSA-2017:3075)	Nessus	Red Hat Local Security Checks	high
104200	Oracle Linux 7 : wget (ELSA-2017-3075)	Nessus	Oracle Linux Local Security Checks	high
104182	Amazon Linux AMI : wget (ALAS-2017-916)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2017-13089

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high