CVE-2010-2252 GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary....
MediumCVSS 6.8
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU wget | <= 1.12 | No fix listed |
| GNU wget | = 1.5.3 | No fix listed |
| GNU wget | = 1.6 | No fix listed |
| GNU wget | = 1.7 | No fix listed |
| GNU wget | = 1.7.1 | No fix listed |
| GNU wget | = 1.8 | No fix listed |
| GNU wget | = 1.8.1 | No fix listed |
| GNU wget | = 1.8.2 | No fix listed |
| GNU wget | = 1.9 | No fix listed |
| GNU wget | = 1.9.1 | No fix listed |
| GNU wget | = 1.10 | No fix listed |
| GNU wget | = 1.10.1 | No fix listed |
| GNU wget | = 1.10.2 | No fix listed |
| GNU wget | = 1.11 | No fix listed |
| GNU wget | = 1.11.1 | No fix listed |
| GNU wget | = 1.11.2 | No fix listed |
| GNU wget | = 1.11.3 | No fix listed |
| GNU wget | = 1.11.4 | No fix listed |
| debian/wget(Debian:12) | < 1.12-2.1 | 1.12-2.1 |
| debian/wget(Debian:13) | < 1.12-2.1 | 1.12-2.1 |
| debian/wget(Debian:14) | < 1.12-2.1 | 1.12-2.1 |
References
- [bug-wget] 20100520 security risk of unexpected download filenames mailing-list
- [bug-wget] 20100520 Re: security risk of unexpected download filenames mailing-list
- [bug-wget] 20100521 Re: security risk of unexpected download filenames mailing-list
- [bug-wget] 20100520 Re: security risk of unexpected download filenames mailing-list
- [bug-wget] 20100521 Re: security risk of unexpected download filenames mailing-list
- [oss-security] 20100517 [oCERT-2010-001] multiple http client unexpected download filename vulnerability mailing-list
- [oss-security] 20100517 Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability mailing-list
- [oss-security] 20100518 Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability mailing-list
- [oss-security] 20100518 Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability mailing-list
- [oss-security] 20100519 Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability mailing-list
- [oss-security] 20100520 Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability mailing-list
- [oss-security] 20100521 Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability mailing-list
- [oss-security] 20100609 Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability mailing-list
- RHSA-2014:0151 vendor-advisory
- www.ocert.org
- 65722 vdb-entry
- bugzilla.redhat.com
- bugzilla.redhat.com
- Debian Security Tracker CVE-2010-2252 vendor-advisory
- bugs.debian.org issue-tracking