CVE-2004-1488 wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and ex...
MediumCVSS 5.0
EPSS 11.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU wget | = 1.8 | No fix listed |
| GNU wget | = 1.8.1 | No fix listed |
| GNU wget | = 1.8.2 | No fix listed |
| GNU wget | = 1.9 | No fix listed |
| GNU wget | = 1.9.1 | No fix listed |
| debian/wget(Debian:12) | < 1.9.1-11 | 1.9.1-11 |
| debian/wget(Debian:13) | < 1.9.1-11 | 1.9.1-11 |
| debian/wget(Debian:14) | < 1.9.1-11 | 1.9.1-11 |
References
- Debian Security Tracker CVE-2004-1488 vendor-advisory
- bugs.debian.org exploit vendor-advisory
- 20041209 wget: Arbitrary file overwriting/appending/creating and other vulnerabilities mailing-list
- 20960 third-party-advisory
- 1012472 vdb-entry
- SUSE-SR:2006:016 vendor-advisory
- RHSA-2005:771 vendor-advisory
- 11871 exploit vdb-entry vendor-advisory
- wget-terminal-overwrite(18421) vdb-entry
- oval:org.mitre.oval:def:9750 signature vdb-entry
- USN-145-1 vendor-advisory