Test Kennung:	1.3.6.1.4.1.25623.1.0.703062
Kategorie:	Debian Local Security Checks
Titel:	Debian Security Advisory DSA 3062-1 (wget - security update)
Zusammenfassung:	HD Moore of Rapid7 discovered a symlink attack in Wget, a command-line;utility to retrieve files via HTTP, HTTPS, and FTP. The vulnerability;allows to create arbitrary files on the user's system when Wget runs in;recursive mode against a malicious FTP server. Arbitrary file creation;may override content of user's files or permit remote code execution with;the user privilege.;;This update changes the default setting in Wget such that it no longer;creates local symbolic links, but rather traverses them and retrieves the;pointed-to file in such a retrieval.
Beschreibung:	Summary: HD Moore of Rapid7 discovered a symlink attack in Wget, a command-line utility to retrieve files via HTTP, HTTPS, and FTP. The vulnerability allows to create arbitrary files on the user's system when Wget runs in recursive mode against a malicious FTP server. Arbitrary file creation may override content of user's files or permit remote code execution with the user privilege. This update changes the default setting in Wget such that it no longer creates local symbolic links, but rather traverses them and retrieves the pointed-to file in such a retrieval. Affected Software/OS: wget on Debian Linux Solution: For the stable distribution (wheezy), this problem has been fixed in version 1.13.4-3+deb7u2. For the unstable distribution (sid), this problem has been fixed in version 1.16-1. We recommend that you upgrade your wget packages. CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2014-4877 BugTraq ID: 70751 http://www.securityfocus.com/bid/70751 CERT/CC vulnerability note: VU#685996 http://www.kb.cert.org/vuls/id/685996 Debian Security Information: DSA-3062 (Google Search) http://www.debian.org/security/2014/dsa-3062 http://security.gentoo.org/glsa/glsa-201411-05.xml http://www.mandriva.com/security/advisories?name=MDVSA-2015:121 https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access https://github.com/rapid7/metasploit-framework/pull/4088 http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00150.html RedHat Security Advisories: RHSA-2014:1764 http://rhn.redhat.com/errata/RHSA-2014-1764.html RedHat Security Advisories: RHSA-2014:1955 http://rhn.redhat.com/errata/RHSA-2014-1955.html SuSE Security Announcement: SUSE-SU-2014:1366 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00004.html SuSE Security Announcement: SUSE-SU-2014:1408 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00009.html SuSE Security Announcement: openSUSE-SU-2014:1380 (Google Search) http://lists.opensuse.org/opensuse-updates/2014-11/msg00026.html http://www.ubuntu.com/usn/USN-2393-1
Copyright	Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.