Ubuntu 2393-1 Moderate: Wget Path Traversal Risk Advisory

ubuntu

October 30, 2014

Wget could be made to overwrite files.

Summary

Wget could be made to overwrite files.

Software Description:

- wget: retrieves files from the web

Details:

HD Moore discovered that Wget contained a path traversal vulnerability

when downloading symlinks using FTP. A malicious remote FTP server or a man

in the middle could use this issue to cause Wget to overwrite arbitrary

files, possibly leading to arbitrary code execution.

Topics Covered

security advisory file overwrite moderate severity ubuntu wget path traversal ftp threat

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  wget                            1.15-1ubuntu1.14.10.1

Ubuntu 14.04 LTS:
  wget                            1.15-1ubuntu1.14.04.1

Ubuntu 12.04 LTS:
  wget                            1.13.4-2ubuntu1.2

Ubuntu 10.04 LTS:
  wget                            1.12-1.1ubuntu2.2

In general, a standard system update will make all the necessary changes.