CVE-1999-0402: Medium severity GNU Wget vulnerability

Published Jan 2, 1999

Updated

wget 1.5.3 follows symlinks to change permissions of the target file instead of the symlink itself.

Affected Software

1 affected component

GNU Wget=1.5.3

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove wget 1.5.3 from your environment.
Uninstall or disable/remove use of wget 1.5.3. This version follows symlinks and may change permissions of the symlink target instead of the symlink itself.
Compensating control
Avoid running wget 1.5.3 against untrusted directories or locations that may contain symlinks. Ensure download directories do not contain untrusted symlinks and restrict write permissions to trusted users until a fixed version is available.

Jan 2, 1999

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

DescriptionSeverityAffected Software

Sep 29, 1999

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

CVE-1999-0402 is considered a moderate severity vulnerability due to its potential for privilege escalation.

To fix CVE-1999-0402, upgrade GNU Wget to a version later than 1.5.3 that does not exhibit this vulnerability.

CVE-1999-0402 specifically affects GNU Wget version 1.5.3.

CVE-1999-0402 can be exploited through symbolic link manipulation to change file permissions.

While CVE-1999-0402 is an older vulnerability, it remains relevant for systems still running outdated versions of GNU Wget.