CVE-2016-4971

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-4971
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=e996e322ffd42aaa051602da182d03178d0f13e1 Patch Vendor Advisory
http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html Mailing List Patch Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2016-08/msg00043.html Broken Link
http://packetstormsecurity.com/files/162395/GNU-wget-Arbitrary-File-Upload-Code-Execution.html Exploit Third Party Advisory VDB Entry
http://rhn.redhat.com/errata/RHSA-2016-2587.html Broken Link
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html Third Party Advisory
http://www.securityfocus.com/bid/91530 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1036133 Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-3012-1 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1343666 Exploit Issue Tracking Patch Third Party Advisory
https://security.gentoo.org/glsa/201610-11 Third Party Advisory
https://security.paloaltonetworks.com/CVE-2016-4971 Third Party Advisory
https://www.exploit-db.com/exploits/40064/ Exploit Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:gnu:wget:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*
cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
History

12 Feb 2023, 23:22

Type Values Removed Values Added
Summary It was found that wget used a file name provided by the server for the downloaded file when following a HTTP redirect to a FTP server resource. This could cause wget to create a file with a different name than expected, possibly allowing the server to execute arbitrary code on the client. GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:2587', 'name': 'https://access.redhat.com/errata/RHSA-2016:2587', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2016-4971', 'name': 'https://access.redhat.com/security/cve/CVE-2016-4971', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 21:16

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/errata/RHSA-2016:2587 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2016-4971 -
Summary GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource. It was found that wget used a file name provided by the server for the downloaded file when following a HTTP redirect to a FTP server resource. This could cause wget to create a file with a different name than expected, possibly allowing the server to execute arbitrary code on the client.

05 May 2021, 14:43

Type Values Removed Values Added
References (CONFIRM) http://git.savannah.gnu.org/cgit/wget.git/commit/?id=e996e322ffd42aaa051602da182d03178d0f13e1 - (CONFIRM) http://git.savannah.gnu.org/cgit/wget.git/commit/?id=e996e322ffd42aaa051602da182d03178d0f13e1 - Patch, Vendor Advisory
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-2587.html - (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-2587.html - Broken Link
References (CONFIRM) https://security.paloaltonetworks.com/CVE-2016-4971 - (CONFIRM) https://security.paloaltonetworks.com/CVE-2016-4971 - Third Party Advisory
References (UBUNTU) http://www.ubuntu.com/usn/USN-3012-1 - (UBUNTU) http://www.ubuntu.com/usn/USN-3012-1 - Third Party Advisory
References (SUSE) http://lists.opensuse.org/opensuse-updates/2016-08/msg00043.html - (SUSE) http://lists.opensuse.org/opensuse-updates/2016-08/msg00043.html - Broken Link
References (MISC) http://packetstormsecurity.com/files/162395/GNU-wget-Arbitrary-File-Upload-Code-Execution.html - (MISC) http://packetstormsecurity.com/files/162395/GNU-wget-Arbitrary-File-Upload-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry
References (GENTOO) https://security.gentoo.org/glsa/201610-11 - (GENTOO) https://security.gentoo.org/glsa/201610-11 - Third Party Advisory
References (BID) http://www.securityfocus.com/bid/91530 - (BID) http://www.securityfocus.com/bid/91530 - Third Party Advisory, VDB Entry
References (CONFIRM) http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html - (CONFIRM) http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html - Third Party Advisory
References (SECTRACK) http://www.securitytracker.com/id/1036133 - (SECTRACK) http://www.securitytracker.com/id/1036133 - Third Party Advisory, VDB Entry
References (MLIST) http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html - Vendor Advisory (MLIST) http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html - Mailing List, Patch, Vendor Advisory
References (EXPLOIT-DB) https://www.exploit-db.com/exploits/40064/ - (EXPLOIT-DB) https://www.exploit-db.com/exploits/40064/ - Exploit, Third Party Advisory, VDB Entry
References (CONFIRM) https://bugzilla.redhat.com/show_bug.cgi?id=1343666 - Exploit (CONFIRM) https://bugzilla.redhat.com/show_bug.cgi?id=1343666 - Exploit, Issue Tracking, Patch, Third Party Advisory
CPE cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
cpe:2.3:a:gnu_wget_project:gnu_wget:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*		 cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
cpe:2.3:a:gnu:wget:*:*:*:*:*:*:*:*
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
CWE CWE-254 NVD-CWE-noinfo

30 Apr 2021, 17:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/162395/GNU-wget-Arbitrary-File-Upload-Code-Execution.html -
Information

Published : 2016-06-30 17:59

Updated : 2023-12-10 11:46

NVD link : CVE-2016-4971

Mitre link : CVE-2016-4971

CVE.ORG link : CVE-2016-4971

JSON object : View

Products Affected

gnu

  • wget

paloaltonetworks

  • pan-os

canonical

  • ubuntu_linux

oracle

  • solaris
CWE
NVD-CWE-noinfo