sm-grimoire AT lists.ibiblio.org
Subject: Discussion of Spells and Grimoire items
List archive
[SM-Grimoire]Re: [SM-Spell-Submit]securty fix: wget
- From: "Sergey A. Lipnevich" <sergeyli AT pisem.net>
- To: shivaken <shivaken AT jcom.home.ne.jp>, eschabell AT sourcemage.org
- Cc: sm-grimoire AT lists.ibiblio.org
- Subject: [SM-Grimoire]Re: [SM-Spell-Submit]securty fix: wget
- Date: Thu, 12 Dec 2002 10:25:10 -0500
Unrolled patch from bz2 and applied. Thanks a lot! Eric, could you please promote `ftp/wget' to test and maybe even to stable? I don't know hot stable it is but it does build and work.
shivaken wrote:
Hi, a security hole is found in wget.
A vulnerability in all versions of wget prior to and including 1.8.2
was discovered by Steven M. Christey. The bug permits a malicious
FTP server to create or overwriet files anywhere on the local file
system by sending filenames beginning with "/" or containing "/../".
This can be used to make vulnerable FTP clients write files that can
later be used for attack against the client machine.
http://marc.theaimsgroup.com/?l=bugtraq&m=87602746719482
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1344
http://linuxtoday.com/news_story.php3?ltsn=2002-12-12-012-26-NW-MD-SW
This spell contains patch (from mandrake's source rpm).
-
[SM-Grimoire]Re: [SM-Spell-Submit]securty fix: wget,
Sergey A. Lipnevich, 12/12/2002
-
[SM-Grimoire]Re: [SM-Spell-Submit]securty fix: wget,
Eric Schabell, 12/12/2002
- Re: [SM-Grimoire]Re: [SM-Spell-Submit]securty fix: wget, Robin, 12/13/2002
-
[SM-Grimoire]Re: [SM-Spell-Submit]securty fix: wget,
Eric Schabell, 12/12/2002
Archive powered by MHonArc 2.6.24.