Summary
The remote host is missing an update to wget
announced via advisory DSA 209-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20209-1
Insight
Two problems have been found in the wget package as distributed in Debian GNU/Linux:
* Stefano Zacchiroli found a buffer overrun in the url_filename function, which would make wget segfault on very long URLs
* Steven M. Christey discovered that wget did not verify the FTP server response to a NLST command: it must not contain any directory information, since that can be used to make a FTP client overwrite arbitrary files.
Both problems have been fixed in version 1.5.3-3.1 for Debian GNU/Linux 2.2/potato and version 1.8.1-6.1 for Debian GNU/Linux 3.0/woody.
Severity
Classification
-
CVE CVE-2002-1344 -
CVSS Base Score: 5.0
AV:N/AC:L/Au:N/C:N/I:P/A:N
Related Vulnerabilities