Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU33335
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2010-2252
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to read and manipulate data.
GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
MitigationInstall update from vendor's website.
Vulnerable software versionswget: 1.5.3 - 1.12
CPE2.3https://lists.gnu.org/archive/html/bug-wget/2010-05/msg00023.html
https://lists.gnu.org/archive/html/bug-wget/2010-05/msg00031.html
https://lists.gnu.org/archive/html/bug-wget/2010-05/msg00032.html
https://lists.gnu.org/archive/html/bug-wget/2010-05/msg00033.html
https://lists.gnu.org/archive/html/bug-wget/2010-05/msg00034.html
https://marc.info/?l=oss-security&m=127411372529485&w=2
https://marc.info/?l=oss-security&m=127412569216380&w=2
https://marc.info/?l=oss-security&m=127416905831994&w=2
https://marc.info/?l=oss-security&m=127422615924593&w=2
https://marc.info/?l=oss-security&m=127427572721591&w=2
https://marc.info/?l=oss-security&m=127432968701342&w=2
https://marc.info/?l=oss-security&m=127441275821210&w=2
https://marc.info/?l=oss-security&m=127611288927500&w=2
https://rhn.redhat.com/errata/RHSA-2014-0151.html
https://www.ocert.org/advisories/ocert-2010-001.html
https://www.securityfocus.com/bid/65722
https://bugzilla.redhat.com/show_bug.cgi?id=591580
https://bugzilla.redhat.com/show_bug.cgi?id=602797
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.