SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   wget Vendors:   GNU [multiple authors]
(Red Hat Issues Fix) wget Input Validation Flaw in SetCookie Processing Lets Remote Users Inject Arbitrary Cookies on the Target System
SecurityTracker Alert ID:  1041987
SecurityTracker URL:  http://securitytracker.com/id/1041987
CVE Reference:   CVE-2018-0494   (Links to External Site)
Date:  Oct 30 2018
Impact:   Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.7 - 1.19.4
Description:   A vulnerability was reported in wget. A remote user can set and modify cookies on the target system.

The software does not properly process Set-Cookie responses. A remote server can return specially crafted data to inject arbitrary cookies into the cookie jar file on the target system.

The vendor was notified on April 26, 2018.

The original advisory including demonstration exploit steps is available at:

https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt

Harry Sintonen of F-Secure Corporation reported this vulnerability.

Impact:   A remote user can set and modify cookies on the target system.
Solution:   Red Hat has issued a fix.

The Red Hat advisory is available at:

https://access.redhat.com/errata/RHSA-2018:3052

Vendor URL:  access.redhat.com/errata/RHSA-2018:3052 (Links to External Site)
Cause:   Access control error, Input validation error
Underlying OS:  Linux (Red Hat Enterprise)
Underlying OS Comments:  7

Message History:   This archive entry is a follow-up to the message listed below.
May 7 2018 wget Input Validation Flaw in SetCookie Processing Lets Remote Users Inject Arbitrary Cookies on the Target System



 Source Message Contents

Subject:  [RHSA-2018:3052-01] Moderate: wget security and bug fix update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: wget security and bug fix update
Advisory ID:       RHSA-2018:3052-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:3052
Issue date:        2018-10-30
CVE Names:         CVE-2018-0494 
=====================================================================

1. Summary:

An update for wget is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, ppc64le, s390x

3. Description:

The wget packages provide the GNU Wget file retrieval utility for HTTP,
HTTPS, and FTP protocols.

Security Fix(es):

* wget: Cookie injection allows malicious website to write arbitrary cookie
entries into cookie jar (CVE-2018-0494)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.6 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1575634 - CVE-2018-0494 wget: Cookie injection allows malicious website to write arbitrary cookie entries into cookie jar

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
wget-1.14-18.el7.src.rpm

x86_64:
wget-1.14-18.el7.x86_64.rpm
wget-debuginfo-1.14-18.el7.x86_64.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source:
wget-1.14-18.el7.src.rpm

x86_64:
wget-1.14-18.el7.x86_64.rpm
wget-debuginfo-1.14-18.el7.x86_64.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:
wget-1.14-18.el7.src.rpm

ppc64:
wget-1.14-18.el7.ppc64.rpm
wget-debuginfo-1.14-18.el7.ppc64.rpm

ppc64le:
wget-1.14-18.el7.ppc64le.rpm
wget-debuginfo-1.14-18.el7.ppc64le.rpm

s390x:
wget-1.14-18.el7.s390x.rpm
wget-debuginfo-1.14-18.el7.s390x.rpm

x86_64:
wget-1.14-18.el7.x86_64.rpm
wget-debuginfo-1.14-18.el7.x86_64.rpm

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7):

Source:
wget-1.14-18.el7.src.rpm

aarch64:
wget-1.14-18.el7.aarch64.rpm
wget-debuginfo-1.14-18.el7.aarch64.rpm

ppc64le:
wget-1.14-18.el7.ppc64le.rpm
wget-debuginfo-1.14-18.el7.ppc64le.rpm

s390x:
wget-1.14-18.el7.s390x.rpm
wget-debuginfo-1.14-18.el7.s390x.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
wget-1.14-18.el7.src.rpm

x86_64:
wget-1.14-18.el7.x86_64.rpm
wget-debuginfo-1.14-18.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-0494
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBW9gPu9zjgjWX9erEAQgowQ/8C4OuC6FH98E39JounSurSVilp1qqyZ2X
7URqvRPv4ZikXqDpvq0n5snuf1y1pe5DgbadL2C0FTEWfZpoiNXhTKOqvms8fbDf
ljZn/yYr3RC/KG/aqa2/kvXBojQfWebkBKAqSpK92N/5dCVjDCMX/6kb7mOKpge7
x/aZ9QDLwoeA3Ce2a/1r6BZ72QC9D9oi27+4EJjaAnaEH6EkjrMD1gOW11sncBJb
NRky7H/duYcpbrbTL/qKJFeIBckPq257Dl7ThyEedhtW0az0ljhpquKTotTIHxtL
bESSRhoxnvFoztKTVvTAtUqr+EQNeSV88i4bW59zHcOrnothm1s2ou//LFf+nDSy
cgnneUO74mPeuZB1WPr+XHjCVYDxcthXS/On0EEqIB9gmiAn4AZF9IQrzktdXWu/
zsA41P2mOq/PPx9R0V3UjwJzNgNVlldCKzSqicW0TuYtJ6YZ8nKYfvl87oOq+jyO
xq/ixwQ5n1DJS+3hSni8KJ4egk3Zjq15S0n78jOLG2Da/b9e0uJBbcEQqdVAjjdA
ItoFra2fhV18Msv+LCqGYx9uLWJDhu8a5i/2hUqUFtGRORKiqo757geQZ+Gzg/8c
e9t/lkKkwmsQXp1kDf6QivlV2mbJCdp1wPUSiMc7ajqglYQkfNYql7iV5seEgL3r
jQw01uNBQV8=
=VM9H
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC