wget long URL file name buffer overflow
| wget-url-filename-bo (10851) |  Low Risk |
Description:
wget is vulnerable to a denial of service attack, caused by a buffer overflow that can occur when handling long URLs. By sending a URL with an overly long file name to wget, a remote or local attacker could overflow a buffer and cause wget to crash.
Consequences:
Denial of Service
Remedy:
For Debian GNU/Linux:
Upgrade to the latest wget package, as listed below. Refer to DSA-209-1 for more information. See References.
Debian 2.2 (potato): 1.5.3-3.1 or later
Debian 3.0 (woody): 1.8.1-6.1 or later
For Caldera OpenLinux Server and Workstation 3.1.1:
Upgrade to the latest version of wget (1.8.2-1 or later), as listed in SCO Security Advisory CSSA-2003-025.0. See References.
For Conectiva Linux:
Upgrade to the latest wget package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2003:716 for more information. See References.
Conectiva Linux 7.0: 1.8.2-1U70_2cl or later
Conectiva Linux 8: 1.8.2-1U80_2cl or later
Conectiva Linux 9: 1.8.2-13946U90_2cl or later
For Red Hat Linux containing the wget package:
Upgrade to the latest wget package, as listed below. Refer to RHSA-2003:372-08 for more information. See References.
Red Hat Enterprise Linux AS (v. 2.1), ES (v. 2.1), WS (v. 2.1), and Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor: 8.2-14.72 or later
For SGI IRIX:
Apply the 10039 patch for this vulnerability, as listed in SGI Security Advisory 20031203-01-U. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- Conectiva Linux Security Announcement CLSA-2003:716: wget.
- GNU Project Web site: GNU wget.
- SCO Security Advisory CSSA-2003-003.0: wget directory traversal and buffer overrun vulnerabilities.
- SCO Security Advisory CSSA-2003-025.0: OpenLinux: wget: Buffer overflow.
- CVE-2002-1565: Buffer overflow in url_filename function for wget 1.8.1 allows attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long URL.
- CVE-2003-1565: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2002-1565. Reason: This candidate is a duplicate of CVE-2002-1565. Notes: All CVE users should reference CVE-2002-1565 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
- DSA-209: wget -- directory traversal
- RHSA-2003-372: wget security update
Platforms Affected:
- Conectiva Linux 7.0
- Conectiva Linux 8.0
- Conectiva Linux 9.0
- Debian Debian Linux 2.2
- Debian Debian Linux 3.0
- GNU wget
- RedHat Enterprise Linux 2.1 AS
- RedHat Enterprise Linux 2.1 ES
- RedHat Enterprise Linux 2.1 WS
- RedHat Enterprise Linux 2.1 AW
- RedHat Linux Advanced Workstation 2.1 Itanium
- SCO Caldera OpenLinux Server 3.1
- SCO Caldera OpenLinux Server 3.1.1
- SCO Caldera OpenLinux Workstation 3.1
- SCO Caldera OpenLinux Workstation 3.1.1
Reported:
Dec 12, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net