__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN Red Hat Updated wget packages fix directory traversal bug [Red Hat Advisory RHSA-2002:229-13] December 11, 2002 19:00 GMT Number N-022 [REVISED 14 July, 2003] ______________________________________________________________________________ PROBLEM: The wget packages shipped with Red Hat Linux 6.2 through 8.0 contain a security bug which, under certain circumstances, can cause local files to be written outside the download directory. PLATFORM: Red Hat Linux 6.2 Red Hat Linux 7.0 Red Hat Linux 7.1 Red Hat Linux 7.2 Red Hat Linux 7.3 Red Hat Linux 8.0 DAMAGE: A malicious FTP server can send filenames that can be used to direct a vulnerable FTP client to write files that can then be used for later attacks against the client machine. SOLUTION: Apply appropriate updated wget packages, reference list in the advisory. ______________________________________________________________________________ VULNERABILITY The risk is LOW. Under certain circumstances this vulnerability ASSESSMENT: can be exploited. Users should upgrade as soon as they can. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/n-022.shtml ORIGINAL BULLETIN: https://rhn.redhat.com/errata/RHSA-2002-229.html _____________________________________________________________________________ Revision History: 7/14/03 - updated wget packages for IBM's iSeries and pSeries systems released. [***** Start Red Hat Advisory RHSA-2002:229-13 *****] Updated wget packages fix directory traversal bug Advisory: RHSA-2002:229-13 Last updated on: 2003-07-14 Affected Products: Red Hat Linux 6.2 Red Hat Linux 7.0 Red Hat Linux 7.1 Red Hat Linux 7.1 for iSeries Red Hat Linux 7.1 for pSeries Red Hat Linux 7.2 Red Hat Linux 7.3 Red Hat Linux 8.0 CVEs (cve.mitre.org): CAN-2002-1344 Details: The wget packages shipped with Red Hat Linux 6.2 through 8.0 contain a security bug which, under certain circumstances, can cause local files to be written outside the download directory. [Updated 10 July 2003] Added packages for Red Hat Linux on IBM iSeries and pSeries systems Versions of wget prior to 1.8.2-4 contain a bug that permits a malicious FTP server to create or overwrite files anywhere on the local file system. FTP clients must check to see if an FTP server's response to the NLST command includes any directory information along with the list of filenames required by the FTP protocol (RFC 959, section 4.1.3). If the FTP client fails to do so, a malicious FTP server can send filenames beginning with '/' or containing '/../' which can be used to direct a vulnerable FTP client to write files (such as .forward, .rhosts, .shost, etc.) that can then be used for later attacks against the client machine. All Red Hat Linux users using wget < 1.8.2-4 should upgrade to the errata packages which are not vulnerable to this issue. Thanks to Steven M. Christey for his work in discovering this issue in current FTP clients and for providing a patched FTP server to verify the new packages. Updated packages: Red Hat Linux 6.2 -------------------------------------------------------------------------------- SRPMS: wget-1.8.2-4.6x.src.rpm [ via FTP ] [ via HTTP ] 2c06b1ab033d70ec287bb9c91a8daa68 i386: wget-1.8.2-4.6x.i386.rpm [ via FTP ] [ via HTTP ] fffbaeacd02411c23d011b1000f0ab49 Red Hat Linux 7.0 -------------------------------------------------------------------------------- SRPMS: wget-1.8.2-4.70.src.rpm [ via FTP ] [ via HTTP ] 8cfc796d3489f3d19d4af589bb73641b i386: wget-1.8.2-4.70.i386.rpm [ via FTP ] [ via HTTP ] 8c8abf8f81f057dbd74098b87fb9b54c Red Hat Linux 7.1 -------------------------------------------------------------------------------- SRPMS: wget-1.8.2-4.71.src.rpm [ via FTP ] [ via HTTP ] 5e022a0c2f4afe5285a5ed6b8abc0ee8 i386: wget-1.8.2-4.71.i386.rpm [ via FTP ] [ via HTTP ] 229949e6fdde7a02f56999b4271bc5b1 ia64: wget-1.8.2-4.71.ia64.rpm [ via FTP ] [ via HTTP ] e24aba62d9589e0999678f880db6de08 Red Hat Linux 7.1 for iSeries -------------------------------------------------------------------------------- SRPMS: wget-1.8.2-4.71.src.rpm [ via FTP ] [ via HTTP ] 5e022a0c2f4afe5285a5ed6b8abc0ee8 ppc: wget-1.8.2-4.71.ppc.rpm [ via FTP ] [ via HTTP ] d31261babebdd736de7b61a443c0d2c1 Red Hat Linux 7.1 for pSeries -------------------------------------------------------------------------------- SRPMS: wget-1.8.2-4.71.src.rpm [ via FTP ] [ via HTTP ] 5e022a0c2f4afe5285a5ed6b8abc0ee8 ppc: wget-1.8.2-4.71.ppc.rpm [ via FTP ] [ via HTTP ] d31261babebdd736de7b61a443c0d2c1 Red Hat Linux 7.2 -------------------------------------------------------------------------------- SRPMS: wget-1.8.2-4.72.src.rpm [ via FTP ] [ via HTTP ] eefe85c57b07aa14522ab79a5c2f5607 i386: wget-1.8.2-4.72.i386.rpm [ via FTP ] [ via HTTP ] 03ae8545b03f137b72b57dc2b2e91e22 ia64: wget-1.8.2-4.72.ia64.rpm [ via FTP ] [ via HTTP ] 9f349807fbd8ecc7a2678af45e5d4ad1 Red Hat Linux 7.3 -------------------------------------------------------------------------------- SRPMS: wget-1.8.2-4.73.src.rpm [ via FTP ] [ via HTTP ] 554d83dadce4e18f0c601c571d43564e i386: wget-1.8.2-4.73.i386.rpm [ via FTP ] [ via HTTP ] 20deb3f2c37f331e87a473fb1cac3d83 Red Hat Linux 8.0 -------------------------------------------------------------------------------- SRPMS: wget-1.8.2-5.src.rpm [ via FTP ] [ via HTTP ] 2ab86f0e4955e8e5dc9bf37a4037bfcf i386: wget-1.8.2-5.i386.rpm [ via FTP ] [ via HTTP ] efbebb343ded09fc553e5a34c75697f0 Solution Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1344 http://marc.theaimsgroup.com/?l=bugtraq&m=87602746719482 Keywords: client, directory, flaw:dot, ftp, traversal, wget -------------------------------------------------------------------------------- The listed packages are GPG signed by Red Hat, Inc. for security. Our key is available at: http://www.redhat.com/solutions/security/news/publickey/#key You can verify each package and see who signed it with the following command: rpm --checksig -v filename If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: md5sum filename The Red Hat security contact is security@redhat.com. More contact details at http://www.redhat.com/solutions/security/news/contact.html Copyright © 2002 Red Hat, Inc. All rights reserved. [***** End Red Hat Advisory RHSA-2002:229-13 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of Red Hat for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) N-012: Windows 2000 Default Permissions Could Allow Trojan Horse Program N-013: ISC Remote Vulnerabilities in BIND4 and BIND8 N-014: Trojan Horse tcpdump and libpcap Distributions N-015: SGI IRIX lpd Daemon Vulnerabilities via sendmail and dns N-016: Buffer Overrun in Microsoft Data Access Components (MDAC) N-017: Cisco PIX Multiple Vulnerabilities N-018: Microsoft Cumulative Patch for Internet Explorer N-019: Samba Encrypted Password Buffer Overrun Vulnerability N-020: Red Hat Multiple Vulnerabilities in KDE N-021: Cumulative Patch for Internet Explorer