NA
CVSSv3

CVE-2002-1344

CVSSv4: NA | CVSSv3: NA | CVSSv2: 5 | VMScore: 600 | EPSS: 0.16315 | KEV: Not Included
Published: 18/12/2002 Updated: 20/11/2024

Vulnerability Summary

Directory traversal vulnerability in wget prior to 1.8.2-4 allows a remote FTP server to create or overwrite files as the wget user via filenames containing (1) /absolute/path or (2) .. (dot dot) sequences.

Vulnerable Product Search on Vulmon Subscribe to Product

gnu wget 1.5.3

gnu wget 1.6

gnu wget 1.7

gnu wget 1.7.1

gnu wget 1.8

gnu wget 1.8.1

gnu wget 1.8.2

sun cobalt raq xtr

Vendor Advisories

Two problems have been found in the wget package as distributed in Debian GNU/Linux: Stefano Zacchiroli found a buffer overrun in the url_filename function, which would make wget segfault on very long URLs Steven M Christey discovered that wget did not verify the FTP server response to a NLST command: it must not contain any directory infor ...

References

NVD-CWE-Otherhttps://nvd.nist.govhttps://www.debian.org/security/./dsa-209https://www.kb.cert.org/vuls/id/210148https://www.first.org/epssftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-003.0.txthttp://archives.neohapsis.com/archives/vulnwatch/2002-q4/0102.htmlhttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000552http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000552http://marc.info/?l=bugtraq&m=103962838628940&w=2http://marc.info/?l=bugtraq&m=104033016703851&w=2http://www.ciac.org/ciac/bulletins/n-022.shtmlhttp://www.iss.net/security_center/static/10820.phphttp://www.kb.cert.org/vuls/id/210148http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-086.phphttp://www.openpkg.com/security/advisories/OpenPKG-SA-2003.007.htmlhttp://www.redhat.com/support/errata/RHSA-2002-229.htmlhttp://www.redhat.com/support/errata/RHSA-2002-256.htmlhttp://www.securityfocus.com/archive/1/307045/30/26300/threadedhttp://www.securityfocus.com/bid/6352http://www.securityfocus.com/bid/6360https://www.debian.org/security/2002/dsa-209ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-003.0.txthttp://archives.neohapsis.com/archives/vulnwatch/2002-q4/0102.htmlhttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000552http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000552http://marc.info/?l=bugtraq&m=103962838628940&w=2http://marc.info/?l=bugtraq&m=104033016703851&w=2http://www.ciac.org/ciac/bulletins/n-022.shtmlhttp://www.iss.net/security_center/static/10820.phphttp://www.kb.cert.org/vuls/id/210148http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-086.phphttp://www.openpkg.com/security/advisories/OpenPKG-SA-2003.007.htmlhttp://www.redhat.com/support/errata/RHSA-2002-229.htmlhttp://www.redhat.com/support/errata/RHSA-2002-256.htmlhttp://www.securityfocus.com/archive/1/307045/30/26300/threadedhttp://www.securityfocus.com/bid/6352http://www.securityfocus.com/bid/6360https://www.debian.org/security/2002/dsa-209