1. Ubuntu Security Notices
  2. USN-982-1

USN-982-1: Wget vulnerability

Publication date

2 September 2010

Overview

Releases

Packages

Details

It was discovered that Wget would use filenames provided by the server when
following 3xx redirects. If a user or automated system were tricked into
downloading a file from a malicious site, a remote attacker could create
the file with an arbitrary name (e.g. .wgetrc), and possibly run arbitrary
code.

It was discovered that Wget would use filenames provided by the server when
following 3xx redirects. If a user or automated system were tricked into
downloading a file from a malicious site, a remote attacker could create
the file with an arbitrary name (e.g. .wgetrc), and possibly run arbitrary
code.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

ATTENTION: This update changes previous behaviour by ignoring the filename supplied by the server during redirects. To re-enable previous behaviour, use the new --trust-server-names option.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
9.10 karmic wget –  1.11.4-2ubuntu2.1
9.04 jaunty wget –  1.11.4-2ubuntu1.2
8.04 hardy wget –  1.10.2-3ubuntu1.2
6.06 dapper wget –  1.10.2-1ubuntu1.2
10.04 lucid wget –  1.12-1.1ubuntu2.1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›