CVE-2017-13089
HighSummary
The http.c:skip_short_body() function in wget before version 1.19.2 does not check the length of response chunks, which can lead to passing a negative value to the fd_read() function. This creates an opportunity for an attacker to control the length argument.
Risk Assessment
An attacker could exploit this vulnerability to execute unauthorized code or trigger unexpected behavior in the system, potentially leading to serious security implications for the organization.
Recommendation
It is recommended to update wget to version 1.19.2 or later to eliminate this vulnerability and to conduct a security audit of applications using wget.
Other vulnerabilities in wget
See all- CVE-2017-13090High
The retr.c:fd_read_body() function processes OK responses, but in wget versions before 1.19.2, it does not check the length of chunks, which can lead to passing a negative value to fd_read(). This allows an attacker to control the length argument, potentially corrupting malloc metadata.
- CVE-2016-7098High
A race condition in wget 1.17 and earlier may allow remote servers to bypass intended access list restrictions when downloading a single file in recursive or mirroring mode.
- CVE-1999-0402Medium
Version 1.5.3 of wget follows symlinks, leading to permission changes on the target file instead of the symlink itself.
Original NVD description (English source)
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.