PT-2014-1930 · Gnu+5 · Gnu Wget+5

Hdm · Publicado 2014-10-28 · Atualizado 2024-06-15 · CVE-2014-4877

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GNU Wget versions prior to 1.16

Description The issue allows remote FTP servers to write to arbitrary files and execute arbitrary code when recursion is enabled, through a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation can be carried out remotely.

Recommendations For GNU Wget versions prior to 1.16, consider disabling recursion to minimize the risk of exploitation until a patch is available. Restrict access to arbitrary files to prevent potential code execution.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

ALT-PU-2014-2303

ALT-PU-2015-1257

BDU:2015-09791

CESA-2014_1764

CVE-2014-4877

DLA-82-1

DSA-3062-1

MGASA-2014-0431

OPENSUSE-SU-2024:10263-1

RHSA-2014:1764

RHSA-2014:1955

RHSA-2014_1764

SUSE-SU-2014_1366-1

SUSE-SU-2014_1366-2

SUSE-SU-2014_1408-1

SUSE-SU-2014_1464-1

USN-2393-1

Produtos afetados

Alt Linux

Centos

Gnu Wget

Red Hat

Suse

Ubuntu

Referências · 43

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/server/wget_symlink_file_write.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/pull/4088 · Exploit
• 🔥 https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access · Exploit
• https://security-tracker.debian.org/tracker/CVE-2014-4877 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-4877 · Nota de Segurança
• http://ubuntu.com/usn/USN-2393-1 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2014-1955.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2012-4929 · Nota
• https://osv.dev/vulnerability/MGASA-2014-0431 · Aviso do Fabricante
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 · Nota
• https://suse.com/security/cve/CVE-2014-4877 · Nota
• https://kc.mcafee.com/corporate/index?page=content&id=SB10106 · Nota
• http://advisories.mageia.org/MGASA-2014-0431.html · Nota
• http://git.savannah.gnu.org/cgit/wget.git/commit/?id=b4440d96cf8173d68ecaa07c36b8f4316ee794d0 · Correção
• https://ubuntu.com/security/notices/USN-2393-1 · Aviso do Fabricante