CVE-2017-13089
published 2017-10-27CVE-2017-13089: The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before…
PriorityP263high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
79.86%
99.6th percentile
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | wget | < wget 1.19.2-1 (bookworm) | wget 1.19.2-1 (bookworm) |
| gnu | wget | <= 1.19.1 | — |
| gnu | wget | >= 0 < 1.19.2-1 | 1.19.2-1 |
| gnu | wget | >= 0 < 1.19.2-1 | 1.19.2-1 |
| gnu | wget | >= 0 < 1.19.2-1 | 1.19.2-1 |
| gnu | wget | >= 0 < 1.19.2-1 | 1.19.2-1 |
| gnu | wget | >= 0 < 1.15-1ubuntu1.14.04.3 | 1.15-1ubuntu1.14.04.3 |
| gnu | wget | >= 0 < 1.17.1-1ubuntu1.3 | 1.17.1-1ubuntu1.3 |
| gnu_project | wget | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: the vulnerability is exercised when a malicious HTTP server sends a chunked-encoded response with a negative chunk length value during redirect processing, causing skip_short_body() to pass an attacker-controlled length to fd_read() ↗
- →Attack vector: a remote attacker must trick a user into connecting to a malicious HTTP server that returns a specially crafted chunked HTTP response (e.g., during a redirect), enabling stack-based buffer overflow and potential arbitrary code execution ↗
- →Vulnerable code path: http.c:skip_short_body() called during redirect processing is the entry point; monitor for wget processes handling redirected chunked HTTP responses from untrusted servers ↗
- ·Only wget versions before 1.19.2 are vulnerable; Red Hat Enterprise Linux 5 and 6 shipped versions are NOT affected — only RHEL 7 is affected ↗
- ·The vulnerability only triggers when the HTTP response uses chunked transfer encoding; non-chunked responses do not exercise the vulnerable code path ↗
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Wget vulnerabilities
vendor_ubuntu·2017-10-30·CVSS 8.1
CVE-2016-7098 [HIGH] Wget vulnerabilities
Title: Wget vulnerabilities
Summary: Several security issues were fixed in Wget.
USN-3464-1 fixed several vulnerabilities in Wget. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Antti Levomäki, Christian Jalio, and Joonas Pihlaja discovered that Wget
incorrectly handled certain HTTP responses. A remote attacker could use
this issue to cause Wget to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2017-13089, CVE-2017-13090)
Dawid Golunski discovered that Wget incorrectly handled recursive or
mirroring mode. A remote attacker could possibly use this issue to bypass
intended access list restrictions. (CVE-2016-7098)
Orange Tsai discovered that Wget incorrectly handled CRLF sequences in
HTTP headers. A remo
Ubuntu
Wget vulnerabilities
vendor_ubuntu·2017-10-26·CVSS 8.1
CVE-2016-7098 [HIGH] Wget vulnerabilities
Title: Wget vulnerabilities
Summary: Several security issues were fixed in Wget.
Antti Levomäki, Christian Jalio, and Joonas Pihlaja discovered that Wget
incorrectly handled certain HTTP responses. A remote attacker could use
this issue to cause Wget to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2017-13089, CVE-2017-13090)
Dawid Golunski discovered that Wget incorrectly handled recursive or
mirroring mode. A remote attacker could possibly use this issue to bypass
intended access list restrictions. (CVE-2016-7098)
Orange Tsai discovered that Wget incorrectly handled CRLF sequences in
HTTP headers. A remote attacker could possibly use this issue to inject
arbitrary HTTP headers. (CVE-2017-6508)
Instructions: In general, a standard system update wil
Red Hat
wget: Stack-based buffer overflow in HTTP protocol handling
vendor_redhat·2017-10-26·CVSS 8.8
CVE-2017-13089 [HIGH] CWE-121 wget: Stack-based buffer overflow in HTTP protocol handling
wget: Stack-based buffer overflow in HTTP protocol handling
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.
A stack-based buffer overflow when processing chunked, encoded HTTP responses was found in wget. By tricking an unsuspecting user i
Debian
CVE-2017-13089: wget - The http.c:skip_short_body() function is called in some circumstances, such as w...
vendor_debian·2017·CVSS 8.8
CVE-2017-13089 [HIGH] CVE-2017-13089: wget - The http.c:skip_short_body() function is called in some circumstances, such as w...
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.
Scope: local
bookworm: resolved (fixed in 1.19.2-1)
bullseye: resolved (fixed in 1.19.2-1)
forky: resolved (fixed in 1.19.2-1)
sid: resolved (fixed in 1.19.2-1)
trixie: resolved (fixed in 1.19.
GHSA
GHSA-3737-prh2-4m4p: The http
ghsa_unreviewed·2022-05-14
CVE-2017-13089 [HIGH] CWE-119 GHSA-3737-prh2-4m4p: The http
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.
OSV
CVE-2017-13089: The http
osv·2017-10-27·CVSS 8.8
CVE-2017-13089 [HIGH] CVE-2017-13089: The http
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.
OSV
wget vulnerabilities
osv·2017-10-26·CVSS 8.1
CVE-2017-13089 [HIGH] wget vulnerabilities
wget vulnerabilities
Antti Levomäki, Christian Jalio, and Joonas Pihlaja discovered that Wget
incorrectly handled certain HTTP responses. A remote attacker could use
this issue to cause Wget to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2017-13089, CVE-2017-13090)
Dawid Golunski discovered that Wget incorrectly handled recursive or
mirroring mode. A remote attacker could possibly use this issue to bypass
intended access list restrictions. (CVE-2016-7098)
Orange Tsai discovered that Wget incorrectly handled CRLF sequences in
HTTP headers. A remote attacker could possibly use this issue to inject
arbitrary HTTP headers. (CVE-2017-6508)
No detection rules found.
No public exploits indexed.
HackerOne
CVE-2017-13089 wget stack smash
hackerone·2019-11-12·CVSS 8.8
CVE-2017-13089 [HIGH] CVE-2017-13089 wget stack smash
CVE-2017-13089 wget stack smash
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.
Reproduction:
To reproduce, use two terminals. In the first terminal:
$ nc -l -p 8080 <wget-stack-smash.reply
In the second terminal:
$ wget http://127.0.0.1:8
Bugzilla
CVE-2017-13089 CVE-2017-13090 wget: various flaws [fedora-all]
bugzilla·2017-10-26·CVSS 8.8
CVE-2017-13089 [HIGH] CVE-2017-13089 CVE-2017-13090 wget: various flaws [fedora-all]
CVE-2017-13089 CVE-2017-13090 wget: various flaws [fedora-all]
Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug. This will ensure that all associated bugs get updated
when new packages are pushed to stable.
# bugfix, security, enhancement, newpackage (required)
type=security
# testing, stable
request=testing
# Bug numbers: 1234,9876
bugs=1505444,1505445,1506720
# Description of your update
notes=Security fix for [PUT CVEs HERE]
# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3
# Automatically close bugs when this marked as stable
close_bugs=True
# Suggest that users restart after update
sugge
Bugzilla
CVE-2017-13089 wget: Stack-based buffer overflow in HTTP protocol handling
bugzilla·2017-10-23·CVSS 8.8
CVE-2017-13089 [HIGH] CVE-2017-13089 wget: Stack-based buffer overflow in HTTP protocol handling
CVE-2017-13089 wget: Stack-based buffer overflow in HTTP protocol handling
A stack-based buffer overflow vulnerability was found in HTTP protocol handling, potentially allowing a code execution.
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.
Discussion:
Crea
arXiv
MIRAGE: Multi-Binary Image Risk Assessment with Attack Graph Employment
arxiv_fulltext·2023-11-06
MIRAGE: Multi-Binary Image Risk Assessment with Attack Graph Employment
MIRAGE: Multi-Binary Image Risk Assessment with Attack Graph Employment
David Tayouri, Telem Nachum, Asaf Shabtai
Dept. of Software and Information Systems Engineering
Ben-Gurion University of the Negev
Beer-Sheva, Israel
\davidtay,telemn\@post.bgu.ac.il, [email protected]
## Abstract
Attackers can exploit known vulnerabilities to infiltrate a device's firmware and the communication between firmware binaries, in order to pass between them.
To improve cybersecurity, organizations must identify and mitigate the risks of the firmware they use.
An attack graph (AG) can be used to assess and visually display firmware's risks by organizing the identified vulnerabilities into attack paths composed of sequences of actions attackers may perform to compromise firmware images.
In this paper,
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734ea5125770989c215df3fhttp://www.debian.org/security/2017/dsa-4008http://www.securityfocus.com/bid/101592http://www.securitytracker.com/id/1039661https://access.redhat.com/errata/RHSA-2017:3075https://github.com/r1b/CVE-2017-13089https://security.gentoo.org/glsa/201711-06https://www.synology.com/support/security/Synology_SA_17_62_Wgethttps://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.htmlhttp://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734ea5125770989c215df3fhttp://www.debian.org/security/2017/dsa-4008http://www.securityfocus.com/bid/101592http://www.securitytracker.com/id/1039661https://access.redhat.com/errata/RHSA-2017:3075https://github.com/r1b/CVE-2017-13089https://security.gentoo.org/glsa/201711-06https://www.synology.com/support/security/Synology_SA_17_62_Wgethttps://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.html
2017-10-27
Published