PT-2009-1103 · Gnu+1 · Gnu Wget+1

Tomas Hoger · Published 2009-09-30 · Updated 2017-09-19 · CVE-2009-3490

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNU Wget versions prior to 1.12

Description The issue allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out remotely.

Recommendations For GNU Wget versions prior to 1.12, update to version 1.12 or later to resolve the issue. As a temporary workaround, consider restricting the use of SSL connections until a patch is available. Avoid using GNU Wget for sensitive operations over SSL until the issue is resolved.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

BDU:2015-09408

CVE-2009-3490

DSA-1904-1

RHSA-2009:1549

RHSA-2009_1549

Affected Products

Gnu Wget

Red Hat

References · 19

• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3490 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09408 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-3490 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2009-3490 · Vendor Advisory
• http://secunia.com/advisories/36540 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-3490 · Vendor Advisory
• http://vupen.com/english/advisories/2009/2498 · Vendor Advisory
• http://hg.addictivecode.org/wget/mainline/rev/1eab157d3be7 · Note
• http://marc.info/?l=oss-security&m=125198917018936&w=2 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=520454 · Note
• http://permalink.gmane.org/gmane.comp.web.wget.general/8972 · Note
• https://access.redhat.com/security/cve/CVE-2009-3490 · Note
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11099 · Note
• https://access.redhat.com/errata/RHSA-2009:1549 · Note