CVE-2014-4877
30Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendepss 40%
de la publicación al arma0 días
Publicada en NVD29 oct
metasploit27 oct
probabilidad de explotación
40%top 2% de las CVE
explotación observada
noninguna fuente lo reporta
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
Productos afectados
n/a · n/aReferencias
http://advisories.mageia.org/MGASA-2014-0431.htmlhttp://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7http://git.savannah.gnu.org/cgit/wget.git/commit/?id=b4440d96cf8173d68ecaa07c36b8f4316ee794d0http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00150.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-11/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-11/msg00009.htmlhttp://lists.opensuse.org/opensuse-updates/2014-11/msg00026.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1764.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1955.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1139181https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-accesshttp://security.gentoo.org/glsa/glsa-201411-05.xml