Skip to Content.
Sympa Menu

sm-grimoire - [SM-Grimoire]Re: [SM-Spell-Submit]securty fix: wget

sm-grimoire AT lists.ibiblio.org

Subject: Discussion of Spells and Grimoire items

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergeyli AT pisem.net>
  • To: shivaken <shivaken AT jcom.home.ne.jp>, eschabell AT sourcemage.org
  • Cc: sm-grimoire AT lists.ibiblio.org
  • Subject: [SM-Grimoire]Re: [SM-Spell-Submit]securty fix: wget
  • Date: Thu, 12 Dec 2002 10:25:10 -0500

Unrolled patch from bz2 and applied. Thanks a lot! Eric, could you please promote `ftp/wget' to test and maybe even to stable? I don't know hot stable it is but it does build and work.

shivaken wrote:

Hi, a security hole is found in wget.


A vulnerability in all versions of wget prior to and including 1.8.2
was discovered by Steven M. Christey. The bug permits a malicious
FTP server to create or overwriet files anywhere on the local file
system by sending filenames beginning with "/" or containing "/../".
This can be used to make vulnerable FTP clients write files that can
later be used for attack against the client machine.


http://marc.theaimsgroup.com/?l=bugtraq&m=87602746719482
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1344
http://linuxtoday.com/news_story.php3?ltsn=2002-12-12-012-26-NW-MD-SW

This spell contains patch (from mandrake's source rpm).






Archive powered by MHonArc 2.6.24.

Top of Page