National Cyber-Alert System

Vulnerability Summary for CVE-2002-1344

Overview

Directory traversal vulnerability in wget before 1.8.2-4 allows a remote FTP server to create or overwrite files as the wget user via filenames containing (1) /absolute/path or (2) .. (dot dot) sequences.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#210148

Name: VU#210148

Hyperlink:http://www.kb.cert.org/vuls/id/210148

External Source: BID

Name: 6352

Type: Advisory; Patch Information

Hyperlink:http://www.securityfocus.com/bid/6352

External Source: REDHAT

Name: RHSA-2002:229

Type: Advisory; Patch Information

Hyperlink:http://www.redhat.com/support/errata/RHSA-2002-229.html

External Source: MANDRAKE

Name: MDKSA-2002:086

Hyperlink:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-086.php

External Source: BUGTRAQ

Name: 20021219 TSLSA-2002-0089 - wget

Type: Advisory

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=104033016703851&w=2

External Source: BID

Name: 6360

Hyperlink:http://www.securityfocus.com/bid/6360

External Source: CALDERA

Name: CSSA-2003.003.0

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/307045/30/26300/threaded

External Source: REDHAT

Name: RHSA-2002:256

Hyperlink:http://www.redhat.com/support/errata/RHSA-2002-256.html

External Source: OPENPKG

Name: OpenPKG-SA-2003.007

Hyperlink:http://www.openpkg.com/security/advisories/OpenPKG-SA-2003.007.html

External Source: XF

Name: wget-ftp-filename-traversal(10820)

Hyperlink:http://www.iss.net/security_center/static/10820.php

External Source: CIAC

Name: N-022

Hyperlink:http://www.ciac.org/ciac/bulletins/n-022.shtml

External Source: DEBIAN

Name: DSA-209

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=103973388702700&w=2

External Source: BUGTRAQ

Name: 20021211 Directory Traversal Vulnerabilities in FTP Clients

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=103962838628940&w=2

External Source: CONECTIVA

Name: CLSA-2002:552

Hyperlink:http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000552

External Source: CONECTIVA

Name: CLA-2002:552

Hyperlink:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000552

External Source: VULNWATCH

Name: 20021210 Directory Traversal Vulnerabilities in FTP Clients

Hyperlink:http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0102.html

External Source: SCO

Name: CSSA-2003-003.0

Hyperlink:ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-003.0.txt