CVE-2017-13089: GNU Wget: stack overflow in HTTP protocol handling
A stack-based buffer overflow vulnerability was found in HTTP protocol handling, potentially allowing a code execution.
The http.c:skipshortbody() function is called in some circumstances, such as when processing redirects. When the response is sent chunked, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fdread(). As fdread() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fdread() with a completely attacker controlled length argument.
Other sources
The http.c:skipshortbody() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fdread(). As fdread() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fdread() with a completely attacker controlled length argument.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-13089?
CVE-2017-13089 is classified as a high severity vulnerability due to its potential impact on the affected systems.
How do I fix CVE-2017-13089?
To mitigate CVE-2017-13089, users should upgrade Wget to version 1.19.2 or later.
What versions of Wget are affected by CVE-2017-13089?
CVE-2017-13089 affects Wget versions up to and including 1.19.1.
Which operating systems are impacted by CVE-2017-13089?
CVE-2017-13089 impacts GNU Wget on Debian GNU/Linux versions 8.0 and 9.0.
What is the functionality impacted by CVE-2017-13089?
CVE-2017-13089 affects the chunk parser in Wget, specifically when processing chunked responses in certain scenarios.