GNU Wget FTP_Syst Function Remote Denial of Service Vulnerability

Bugtraq ID:	21650
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2006-6719
Remote:	Yes
Local:	No
Published:	Dec 18 2006 12:00AM
Updated:	Jan 31 2007 09:38PM
Credit:	Federico L. Bossi Bonin is credited with the discovery of this vulnerability.
Vulnerable:	Trustix Secure Linux 3.0 Trustix Secure Linux 2.2 Trustix Operating System Enterprise Server 2.0 rPath rPath Linux 1 Redhat Fedora Core6 Redhat Fedora Core5 Mandriva Linux Mandrake 2006.0 x86_64 Mandriva Linux Mandrake 2006.0 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 GNU wget 1.10.2 GNU wget 1.10.1 GNU wget 1.10 GNU wget 1.9.1 + MandrakeSoft Corporate Server 3.0 x86_64 + MandrakeSoft Corporate Server 3.0 + Mandriva Linux Mandrake 10.2 x86_64 + Mandriva Linux Mandrake 10.2 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 GNU wget 1.9 GNU wget 1.8.2 + Immunix Immunix OS 7+ + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 9.0 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 + Redhat Linux 8.0 i386 + Redhat Linux 7.3 i386 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.0 i386 + Redhat Linux 6.2 i386 + S.u.S.E. Linux Personal 9.3 + S.u.S.E. Linux Personal 9.2 x86_64 + S.u.S.E. Linux Personal 9.2 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 8.2 + SuSE Linux 8.1 + SuSE Linux 8.0 i386 + SuSE Linux 8.0 + Trustix Secure Linux 1.5 GNU wget 1.8.1 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha GNU wget 1.8 GNU wget 1.7.1 GNU wget 1.7 GNU wget 1.6 GNU wget 1.5.3 + Debian Linux 2.2 sparc + Debian Linux 2.2 powerpc + Debian Linux 2.2 IA-32 + Debian Linux 2.2 arm + Debian Linux 2.2 alpha + Debian Linux 2.2 68k
Not Vulnerable:

GNU Wget FTP_Syst Function Remote Denial of Service Vulnerability

GNU Wget is prone to a remote denial-of-service vulnerability.

Exploiting this issue allows remote attackers to crash the application, denying further service to legitimate users.

Version 1.10.2 is vulnerable; other versions may also be affected.

GNU Wget FTP_Syst Function Remote Denial of Service Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/wget-PoC.pl

GNU Wget FTP_Syst Function Remote Denial of Service Vulnerability

Solution:
Fedora Updates FEDORA-2007-037 for Fedora Core 5 and FEDORA-2007-043 for Fedora Core 6 are available; please see the reference section for details.


GNU wget 1.10

• Mandriva wget-1.10-1.2.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://www.mandriva.com/en/download


• Mandriva wget-1.10-1.2.20060mdk.src.rpm
  Mandriva Linux 2006.0:
  http://www.mandriva.com/en/download


• Mandriva wget-1.10-1.2.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0:
  http://www.mandriva.com/en/download


• Mandriva wget-1.10-1.2.20060mlcs4.i586.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva wget-1.10-1.2.20060mlcs4.src.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva wget-1.10-1.2.20060mlcs4.x86_64.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download

GNU wget 1.10.2

• Mandriva wget-1.10.2-3.1mdv2007.0.i586.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva wget-1.10.2-3.1mdv2007.0.src.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva wget-1.10.2-3.1mdv2007.0.x86_64.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download

GNU wget 1.8.1

• Mandriva wget-1.9.1-4.4.M20mdk.i586.rpm
  Multi Network Firewall 2.0:
  http://www.mandriva.com/en/download


• Mandriva wget-1.9.1-4.4.M20mdk.src.rpm
  Multi Network Firewall 2.0:
  http://www.mandriva.com/en/download

GNU wget 1.9.1

• Mandriva wget-1.9.1-4.4.C30mdk.i586.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva wget-1.9.1-4.4.C30mdk.src.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva wget-1.9.1-4.4.C30mdk.x86_64.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download

GNU Wget FTP_Syst Function Remote Denial of Service Vulnerability

References:

• [SECURITY] Fedora Core 5 Update: wget-1.10.2-3.3.fc5 (Fedora)
  
• [SECURITY] Fedora Core 6 Update: wget-1.10.2-8.fc6.1 (Fedora)
  
• GNU Wget Homepage (GNU)