[arch-security] [ASA-201710-34] wget: multiple issues

[Christian Rebischke]

Arch Linux Security Advisory ASA-201710-34
==========================================

Severity: Critical
Date    : 2017-10-29
CVE-ID  : CVE-2017-13089 CVE-2017-13090 CVE-2017-6508
Package : wget
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-473

Summary
=======

The package wget before version 1.19.2-1 is vulnerable to multiple
issues including arbitrary code execution and content spoofing.

Resolution
==========

Upgrade to 1.19.2-1.

# pacman -Syu "wget>=1.19.2-1"

The problems have been fixed upstream in version 1.19.2.

Workaround
==========

None.

Description
===========

- CVE-2017-13089 (arbitrary code execution)

A stack-based buffer overflow has been found in the HTTP protocol
handling code of wget < 1.19.2, when processing chunked, encoded HTTP
responses. By tricking an unsuspecting user into connecting to a
malicious HTTP server, an attacker could exploit this flaw to
potentially execute arbitrary code.

- CVE-2017-13090 (arbitrary code execution)

A heap-based buffer overflow has been found in the HTTP protocol
handling code of wget < 1.19.2, when processing chunked encoded HTTP
responses. By tricking an unsuspecting user into connecting to a
malicious HTTP server, an attacker could exploit this flaw to
potentially execute arbitrary code.

- CVE-2017-6508 (content spoofing)

A CRLF injection flaw was found in the way wget < 1.19.2 handled URLs.
A remote attacker could use this flaw to inject arbitrary HTTP headers
in requests, via CRLF sequences in the host sub-component of a URL, by
tricking a user running wget into processing crafted URLs.

Impact
======

By tricking an unsuspecting user into connecting to a malicious host a
remote attacker is able to execute arbitrary code or spoof returned
data.

References
==========

https://bugzilla.redhat.com/show_bug.cgi?id=1505444
https://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734ea5125770989c215df3f
https://bugzilla.redhat.com/show_bug.cgi?id=1505445
https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ba6b44f6745b14dce414761a8e4b35d31b176bba
http://lists.gnu.org/archive/html/bug-wget/2017-03/msg00018.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-6508
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=4d729e322fae359a1aefaafec1144764a54e8ad4
https://security.archlinux.org/CVE-2017-13089
https://security.archlinux.org/CVE-2017-13090
https://security.archlinux.org/CVE-2017-6508
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20171030/963a9c8d/attachment.asc>