Security Features in wget - CVE-2016-4971

Vulnerability identifier: #VU32275

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-4971

CWE-ID: CWE-254

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

wget
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server for ARM
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - Extended Update Support
Slackware Linux
Fedora
wget (Alpine package)
wget (Red Hat package)
wget
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data

Install update from vendor's website.

wget - update to 1.18
wget (Alpine package) - addressed in versions 1.17.1-r1, 1.18-r0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.0.8
wget (Red Hat package) - update to 1.14-13.el7
wget - addressed in versions 1.18-1.fc22, 1.18-1.fc23, 1.18-1.fc24

• Exploit #5610 - GNU Wget < 1.18 - Arbitrary File Upload / Remote Code Execution (2) (June 17, 2021)

• http://git.savannah.gnu.org/cgit/wget.git/commit/?id=e996e322ffd42aaa051602da182d03178d0f13e1
• http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00043.html
• http://rhn.redhat.com/errata/RHSA-2016-2587.html
• http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
• http://www.securityfocus.com/bid/91530
• http://www.securitytracker.com/id/1036133
• http://www.ubuntu.com/usn/USN-3012-1
• https://bugzilla.redhat.com/show_bug.cgi?id=1343666
• https://security.gentoo.org/glsa/201610-11
• https://security.paloaltonetworks.com/CVE-2016-4971
• https://www.exploit-db.com/exploits/40064/

• Security Features in GNU wget
• Security Features in wget (Alpine package)
• Amazon Linux AMI update for wget
• Gentoo update for GNU Wget
• Slackware Linux update for wget
• IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data update for GNU wget
• Fedora 24 update for wget
• Fedora 23 update for wget
• Fedora 22 update for wget
• Red Hat Enterprise Linux 7 update for wget