REDHAT-BUG-2497850: Buffer Overflow
GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convertfname() function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character set conversion. When the output buffer is too small during iconv E2BIG reallocation, the reallocation logic miscalculates the remaining space, leading to a heap buffer overflow that can be exploited via a maliciously crafted server response.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU Wgetto a version that resolves this vulnerability.Patch c2640fe - Operational
Rebuild/redeploy GNU Wget after applying commit c2640fe to remediate the heap buffer overflow in convert_fname() (src/url.c) triggered by server-supplied filenames and iconv E2BIG reallocation miscalculation.
Event History
Frequently Asked Questions
What attacker capability is required to trigger this issue?
An attacker needs to provide a malicious server response containing a filename that requires character set conversion. The crafted filename must cause the iconv conversion path to encounter an E2BIG buffer reallocation condition.
Which GNU Wget versions are affected?
GNU Wget through version 1.25.0 is affected. The issue is fixed in commit c2640fe.
Which usage scenario is exposed?
Systems using affected GNU Wget versions to interact with attacker-controlled or untrusted servers are exposed when those servers can supply filenames requiring character set conversion.