CVE-2004-2014 Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the name of the file being downloaded.
LowCVSS 2.6
EPSS 0.96%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the name of the file being downloaded.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU wget | = 1.5.3 | No fix listed |
| GNU wget | = 1.6 | No fix listed |
| GNU wget | = 1.7 | No fix listed |
| GNU wget | = 1.7.1 | No fix listed |
| GNU wget | = 1.8 | No fix listed |
| GNU wget | = 1.8.1 | No fix listed |
| GNU wget | = 1.8.2 | No fix listed |
| GNU wget | = 1.9 | No fix listed |
| GNU wget | = 1.9.1 | No fix listed |
| debian/wget(Debian:12) | < 1.9.1-12 | 1.9.1-12 |
| debian/wget(Debian:13) | < 1.9.1-12 | 1.9.1-12 |
| debian/wget(Debian:14) | < 1.9.1-12 | 1.9.1-12 |
References
- Debian Security Tracker CVE-2004-2014 vendor-advisory
- 20040516 Wget race condition vulnerability mailing-list
- [wget] 20040517 Wget race condition vulnerability (fwd) mailing-list
- [wget] 20040517 Re: Wget race condition vulnerability (fwd) mailing-list
- 17399 third-party-advisory
- MDKSA-2005:204 vendor-advisory
- RHSA-2005:771 vendor-advisory
- 10361 exploit vdb-entry
- wget-lock-race-condition(16167) vdb-entry
- oval:org.mitre.oval:def:9830 signature vdb-entry
- USN-145-1 vendor-advisory