Vulnerability Note VU#685996
GNU Wget creates arbitrary symbolic links during recursive FTP download
GNU wget allows arbitrary filesystem access when creating symbolic links during a recursive FTP download. This allows an attacker to overwrite files with the permissions of the user running wget.
CWE-59: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Wget is a common Unix utility to retrieve remote files. When wget is running in recursive mode (the -m or -r switch) with a FTP server as the destination, it is vulnerable to a link following attack. A malicious FTP server, when configured to provide symlinks in the directory listing, can force the client wget utility to enter into the the specified local symlink, navigating the local file system for the attacker. Wget will then download and create or overwrite existing files within the local symlink, setting permissions to those of the remote files.
A remote unauthenticated malicious FTP server, connected to the victim via wget, can create and overwrite arbitrary files in the context of the user running wget.
Apply an Update
Enable wget symlink traversal
Vendor Information (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|GNU wget||Affected||-||28 Oct 2014|
CVSS Metrics (Learn More)
Thanks to HD Moore and John Hart of Rapid7, Inc. for reporting this vulnerability.
This document was written by Chris King.
- CVE IDs: CVE-2014-4877
- Date Public: 27 Oct 2014
- Date First Published: 28 Oct 2014
- Date Last Updated: 31 Oct 2014
- Document Revision: 27
If you have feedback, comments, or additional information about this vulnerability, please send us email.