[arch-security] [Arch Linux Security Advisory ASA-201410-14] wget: arbitrary filesystem access
rgacogne at archlinux.org
Wed Oct 29 08:56:52 UTC 2014
Arch Linux Security Advisory ASA-201410-14
Date : 2014-10-29
CVE-ID : CVE-2014-4877
Package : wget
Type : arbitrary filesystem access
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE-2014
The package wget before version 1.16-2 is vulnerable to arbitrary
Upgrade to 1.16-2.
# pacman -Syu "wget>=1.16-2"
The problem has been fixed upstream in version 1.16.
Do not use the --retr-symlinks=yes option when recursively retrieving a
directory from an untrusted FTP server or over an untrusted connection.
It was found that wget was susceptible to a symlink attack which could
create arbitrary files, directories or symbolic links and set their
permissions when retrieving a directory recursively through FTP.
By default, when retrieving ftp directories recursively and a symbolic
link is encountered, the symbolic link is traversed and the pointed-to
files are retrieved. This option poses a security risk where a malicious
FTP Server may cause Wget to write to files outside of the intended
directories through a specially crafted .listing file.
A malicious FTP server or a malicious attacker in position of
man-in-the-middle could create arbitrary files, directories or symbolic
links and set their permissions when retrieving a directory recursively
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the arch-security