REDHAT-BUG-2497838: Medium severity GNU Wget vulnerability
GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the cleanmetalinkstring() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cause the function to decrement a pointer past the start of the buffer when processing an all-whitespace Metalink URL, potentially leading to abnormal program behavior.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU Wgetto a version that resolves this vulnerability.Patch 37a40fc
Event History
Frequently Asked Questions
What attacker access is required to trigger this issue?
An attacker needs to control or impersonate a server that provides a Metalink document to Wget. The crafted document must contain a URL field made entirely of whitespace.
Which Wget installations are in scope?
GNU Wget through version 1.25.0 is affected according to the available information. The issue is fixed by commit 37a40fc.
What is the likely impact of successful exploitation?
Processing the malicious Metalink URL can make clean_metalink_string() decrement a pointer before the beginning of its buffer, causing a heap buffer underread. This may result in memory corruption and abnormal program behavior.