=====================================================================

                           CERT-Renater

               Note d'Information No. 2014/VULN243
_____________________________________________________________________

DATE                : 31/10/2014

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running GNU wget.

======================================================================
http://www.kb.cert.org/vuls/id/685996
______________________________________________________________________

Vulnerability Note VU#685996

GNU Wget creates arbitrary symbolic links during recursive FTP download

Original Release date: 28 oct. 2014 | Last revised: 29 oct. 2014


Overview

GNU wget allows arbitrary filesystem access when creating symbolic
links during a recursive FTP download. This allows an attacker to
overwrite files with the permissions of the user running wget.
Description

CWE-59: CWE-59: Improper Link Resolution Before File Access ('Link
Following')

Wget is a common Unix utility to retrieve remote files. When wget is
running in recursive mode (the -m or -r switch) with a FTP server as
the destination, it is vulnerable to a link following attack. A
malicious FTP server, when configured to provide symlinks in the
directory listing, can force the client wget utility to enter into the
the specified local symlink, navigating the local file system for the
attacker. Wget will then download and create or overwrite existing
files within the local symlink, setting permissions to those of the
remote files.

See the Rapid7 advisory for more details.


Impact

A remote unauthenticated malicious FTP server, connected to the victim
via wget, can create and overwrite arbitrary files in the context of
the user running wget.


Solution

Apply an Update

The maintainer has released a source update here. The update should
also be available in various package formats for downstream Linux
distributions. Check your distribution's package management system for
updates.

Enable wget symlink traversal

In wget versions 1.15 and earlier, configure retr-symlinks=on in
/etc/wgetrc or ~/.wgetrc or specify --retr-symlinks as a command line
option to wget.


Vendor Information (Learn More)

Vendor	Status	Date Notified	Date Updated

GNU wget	Affected	-	28 Oct 2014

If you are a vendor and your product is affected, let us know.


CVSS Metrics (Learn More)
Group 	Score 	Vector
Base 	5,8 	AV:N/AC:M/Au:N/C:N/I:P/A:P
Temporal 	4,8 	E:F/RL:OF/RC:C
Environmental 	3,6 	CDP:ND/TD:M/CR:ND/IR:ND/AR:ND


References


http://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7
    http://cwe.mitre.org/data/definitions/59.html
    https://bugzilla.redhat.com/show_bug.cgi?id=1139181

https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access

http://www.gnu.org/software/wget/manual/wget.html#index-symbolic-links_002c-retrieving
    http://gnu.huihoo.org/wget-1.8.1/html_node/wget_10.html
    http://comments.gmane.org/gmane.comp.web.wget.general/10367


Credit

Thanks to HD Moore and John Hart of Rapid7, Inc. for reporting this
vulnerability.

This document was written by Chris King.


Other Information

    CVE IDs: CVE-2014-4877
    Date Public: 27 oct. 2014
    Date First Published: 28 oct. 2014
    Date Last Updated: 29 oct. 2014
    Document Revision: 22


Feedback

If you have feedback, comments, or additional information about this
vulnerability, please send us email.


=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================