CVE-2014-4877: Path Traversal
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
Other sources
It was found that wget was susceptible to a symlink attack which could create arbitrary files, directories or symbolic links and set their permissions when retrieving a directory recursively through FTP.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4877?
CVE-2014-4877 has a severity rating that indicates a high risk due to potential arbitrary file writing and code execution.
How do I fix CVE-2014-4877?
To fix CVE-2014-4877, upgrade GNU Wget to version 1.16 or later.
Which versions of GNU Wget are affected by CVE-2014-4877?
CVE-2014-4877 affects GNU Wget versions prior to 1.16, specifically versions 1.15 and lower.
What type of vulnerability is CVE-2014-4877?
CVE-2014-4877 is classified as an absolute path traversal vulnerability leading to potential code execution.
Can CVE-2014-4877 be exploited remotely?
Yes, CVE-2014-4877 can be exploited remotely via malicious FTP servers using specially crafted LIST responses.