CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wget: Lack of filename checking allows arbitrary file upload via FTP redirect (CVE-2016-4971)

  - wget: Cookie injection allows malicious website to write arbitrary cookie entries into cookie jar     (CVE-2018-0494)

  - CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote     attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL.
    (CVE-2017-6508)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wget: FTP symlink arbitrary filesystem access (CVE-2014-4877)

  - wget: Lack of filename checking allows arbitrary file upload via FTP redirect (CVE-2016-4971)

  - GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the     destination filename of a download, which allows remote servers to create or overwrite arbitrary files via     a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted     filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home     directory. (CVE-2010-2252)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - wget: CRLF injection in the url_parse function in url.c (CVE-2017-6508)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the version of the wget package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A CRLF injection flaw was found in the way wget handled     URLs. A remote attacker could use this flaw to inject     arbitrary HTTP headers in requests, via CRLF sequences     in the host sub-component of a URL, by tricking a user     running wget into processing crafted     URLs.(CVE-2017-6508)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the wget package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A CRLF injection flaw was found in the way wget handled     URLs. A remote attacker could use this flaw to inject     arbitrary HTTP headers in requests, via CRLF sequences     in the host sub-component of a URL, by tricking a user     running wget into processing crafted     URLs.(CVE-2017-6508)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the wget package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - CRLF injection vulnerability in the url_parse function     in url.c in Wget through 1.19.1 allows remote attackers     to inject arbitrary HTTP headers via CRLF sequences in     the host subcomponent of a URL.(CVE-2017-6508)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the wget package has been released.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3464-1 advisory.

    Antti Levomki, Christian Jalio, and Joonas Pihlaja discovered that Wget incorrectly handled certain HTTP     responses. A remote attacker could use this issue to cause Wget to crash, resulting in a denial of     service, or possibly execute arbitrary code. (CVE-2017-13089, CVE-2017-13090)

    Dawid Golunski discovered that Wget incorrectly handled recursive or mirroring mode. A remote attacker     could possibly use this issue to bypass intended access list restrictions. (CVE-2016-7098)

    Orange Tsai discovered that Wget incorrectly handled CRLF sequences in HTTP headers. A remote attacker     could possibly use this issue to inject arbitrary HTTP headers. (CVE-2017-6508)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CRLF injection in the url_parse function in url.c

A CRLF injection flaw was found in the way wget handled URLs. A remote attacker could use this flaw to inject arbitrary HTTP headers in requests, via CRLF sequences in the host sub-component of a URL, by tricking a user running wget into processing crafted URLs.
(CVE-2017-6508)

- fixed CVE-2017-6508 CRLF injection in the url_parse     function in url.c

  - fixed use of .netrc

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201706-16 (GNU Wget: Header injection)

    It was discovered that there was a header injection vulnerability in GNU       Wget which allowed remote attackers to inject arbitrary HTTP headers via       CRLF sequences in the host subcomponent of a URL.
  Impact :

    A remote attacker could inject arbitrary HTTP headers in requests by       tricking a user running GNU Wget into processing crafted URLs.
  Workaround :

    There is no known workaround at this time.

Fixed CVE-2017-6508: CRLF injection in the url_parse function in url.c

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for wget fixes the following issues :

Security issue fixed :

  - CVE-2017-6508: (url_parse): Reject control characters in     host part of URL (bsc#1028301).

This update was imported from the SUSE:SLE-12:Update update project.

This update for wget fixes the following issues: Security issue fixed :

  - CVE-2017-6508: (url_parse): Reject control characters in     host part of URL (bsc#1028301).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a header injection vulnerability in wget (a tool to retrieve files from the web) which allowed remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL.

For Debian 7 'Wheezy', this issue has been fixed in wget version 1.13.4-3+deb7u4.

We recommend that you upgrade your wget packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198435	RHEL 6 : wget (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198391	RHEL 5 : wget (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198374	RHEL 7 : wget (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
195402	RHEL 7 : wget (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195367	RHEL 6 : wget (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195357	RHEL 5 : wget (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
134747	EulerOS Virtualization 3.0.2.2 : wget (EulerOS-SA-2020-1281)	Nessus	Huawei Local Security Checks	medium
134491	EulerOS Virtualization for ARM 64 3.0.2.0 : wget (EulerOS-SA-2020-1202)	Nessus	Huawei Local Security Checks	medium
132216	EulerOS 2.0 SP3 : wget (EulerOS-SA-2019-2681)	Nessus	Huawei Local Security Checks	medium
131654	EulerOS 2.0 SP2 : wget (EulerOS-SA-2019-2501)	Nessus	Huawei Local Security Checks	medium
130660	EulerOS 2.0 SP5 : wget (EulerOS-SA-2019-2198)	Nessus	Huawei Local Security Checks	medium
121793	Photon OS 2.0: Wget PHSA-2017-2.0-0008	Nessus	PhotonOS Local Security Checks	medium
121710	Photon OS 1.0: Wget PHSA-2017-0023	Nessus	PhotonOS Local Security Checks	medium
104211	Ubuntu 14.04 LTS / 16.04 LTS : Wget vulnerabilities (USN-3464-1)	Nessus	Ubuntu Local Security Checks	high
102869	Amazon Linux AMI : wget (ALAS-2017-881)	Nessus	Amazon Linux Local Security Checks	medium
101612	Fedora 26 : wget (2017-38c3781b89)	Nessus	Fedora Local Security Checks	medium
100942	GLSA-201706-16 : GNU Wget: Header injection	Nessus	Gentoo Local Security Checks	medium
100750	Fedora 24 : wget (2017-ed1c665a3f)	Nessus	Fedora Local Security Checks	medium
100604	Fedora 25 : wget (2017-22f1a8404e)	Nessus	Fedora Local Security Checks	medium
99111	openSUSE Security Update : wget (openSUSE-2017-412)	Nessus	SuSE Local Security Checks	medium
97915	SUSE SLED12 / SLES12 Security Update : wget (SUSE-SU-2017:0800-1)	Nessus	SuSE Local Security Checks	medium
97914	SUSE SLES11 Security Update : wget (SUSE-SU-2017:0799-1)	Nessus	SuSE Local Security Checks	medium
97642	Debian DLA-851-1 : wget security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2017-6508

medium

Tenable Plugins

high

high

medium

high

high

high

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium