bugGNU Wget - Bugs: bug #20419, wget: [CVE-2006-6719] segfaults on...

 
 

bug #20419: wget: [CVE-2006-6719] segfaults on too many FTP 220 responses at once

Submitted by:  Noël Köthe <nok>
Submitted on:  Mon 09 Jul 2007 09:31:07 PM UTC  
 
Category: Crash/Freeze/InfloopSeverity: 5 - Blocker
Priority: 5 - NormalStatus: Fixed In Repository
Privacy: PublicAssigned to: None
Originator Name: Open/Closed: Closed
Release: 1.10.2Operating System: GNU/Linux
Reproducibility: Every TimeFixed Release: 1.11
Planned Release: 1.11Regression: None
Work Required: NonePatch Included: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 11 Jul 2007 04:33:52 AM UTC, comment #2:

Problem is not present in the trunk, which has added a check for request == NULL.

Fix is not currently present in 1.10 branch.

Micah Cowan <micahcowan>
Mon 09 Jul 2007 09:41:41 PM UTC, comment #1:

CVE description: "The ftp_syst function in ftp-basic.c in Free Software Foundation (FSF) GNU wget 1.10.2 allows remote attackers to cause a denial of service (application crash) via a malicious FTP server with a large number of blank 220 responses to the SYST command."

Micah Cowan <micahcowan>
Mon 09 Jul 2007 09:31:07 PM UTC, original submission:

Hello,

a forwarded report from http://bugs.debian.org/407571 :

"I was able to reproduce the CVE-2006-6719 (DoS from malicious FTP
server against wget <= 1.10.2 by letting it segfault, see
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6719) with wget
versions in Sarge, Etch and Sid (Etch and Sid are the same at the
moment of writing).

How to reproduce:

Download the proof of concept perl script from
http://www.milw0rm.com/exploits/2947 then log in as root and start the
script as root (it's easy to understand and harmless, well, except to
wget... ;-). You'll also find a backtrace in the comments at the
beginning of the script.

The login as a user, and start:

wget --passive-ftp ftp://localhost/bla/fasel

It will segfault.

It's not yet known if this segfault can be exploited to execute some
code with the rights of the wget user (possibly root), so I set the
severity to normal only...

Updates issued by other distributors:

Fedora: http://lwn.net/Articles/217243/
http://lwn.net/Articles/217242/
Mandriva: http://www.mandriva.com/security/advisories?name=MDKSA-2007:017

Further links:

Bugtraq Database: http://www.securityfocus.com/bid/21650
"

thx.

-unavailable-

Noël Köthe <nok>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by micahcowan (Posted a comment)
  • -unavailable- added by nok (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 11 Jul 2007 04:33:52 AM UTCmicahcowanStatusNone=>Fixed In Repository
      Open/ClosedOpen=>Closed
      Fixed ReleaseNone=>1.11
    Mon 09 Jul 2007 09:45:33 PM UTCmicahcowanCategoryNone=>Crash/Freeze/Infloop
      Severity4 - Important=>5 - Blocker
    Mon 09 Jul 2007 09:41:41 PM UTCmicahcowanCategoryUser Interface=>None
      Severity3 - Normal=>4 - Important
      Planned ReleaseNone=>1.11

    Back to the top


    Powered by Savane 3.1-cleanup1