[ GLSA 201110-10 ] Wget: User-assisted file creation or overwrite

[GLSA]

Gentoo Linux Security Advisory

Title: Wget: User-assisted file creation or overwrite (GLSA 201110-10)
Severity: normal
Exploitable: remote
Date: October 13, 2011
Bug(s): #329941
ID: 201110-10

Synopsis

Insecure usage of server provided filenames may allow the creation
or overwriting of local files.


Background

GNU Wget is a free software package for retrieving files using HTTP,
HTTPS and FTP, the most widely-used Internet protocols.


Affected Packages

Package: net-misc/wget
Vulnerable: < 1.12-r2
Unaffected: >= 1.12-r2
Architectures: All supported architectures


Description

It was discovered that Wget was unsafely trusting server-provided
filenames. This allowed attackers to overwrite or create files on the
user's system by sending a redirect from the expected URL to another URL
specifying the targeted file.


Impact

An unauthenticated remote attacker may be able to create or overwrite
local files by enticing the user to open an attacker controlled URL,
possibly leading to execution of arbitrary code.


Workaround

There is no known workaround at this time.

Resolution

All Wget users should upgrade to the latest version: