CVE-2017-13090
HighSummary
The retr.c:fd_read_body() function processes OK responses, but in wget versions before 1.19.2, it does not check the length of chunks, which can lead to passing a negative value to fd_read(). This allows an attacker to control the length argument, potentially corrupting malloc metadata.
Risk Assessment
An attacker can exploit this vulnerability to manipulate memory, leading to serious security issues, including the execution of malicious code.
Recommendation
It is recommended to update wget to version 1.19.2 or later to mitigate this vulnerability.
Other vulnerabilities in wget
See all- CVE-2017-13089High
The http.c:skip_short_body() function in wget before version 1.19.2 does not check the length of response chunks, which can lead to passing a negative value to the fd_read() function. This creates an opportunity for an attacker to control the length argument.
- CVE-2016-7098High
A race condition in wget 1.17 and earlier may allow remote servers to bypass intended access list restrictions when downloading a single file in recursive or mirroring mode.
- CVE-1999-0402Medium
Version 1.5.3 of wget follows symlinks, leading to permission changes on the target file instead of the symlink itself.
Original NVD description (English source)
The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in pieces of 8192 bytes by using the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. The attacker can corrupt malloc metadata after the allocated buffer.