{"id":185,"date":"2016-07-12T15:59:52","date_gmt":"2016-07-12T15:59:52","guid":{"rendered":"http:\/\/www.urolime.com\/blogs\/in\/?p=185"},"modified":"2021-09-21T12:59:25","modified_gmt":"2021-09-21T07:29:25","slug":"wget-cve-arbitrary-file-upload","status":"publish","type":"post","link":"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/","title":{"rendered":"Wget CVE-2016-4971: Arbitrary File Upload"},"content":{"rendered":"

CVE-2016-4971 [Arbitrary File Upload \/ Potential Remote Code Execution]<\/strong><\/p>\n

Severity: High below 1.8 version.<\/p>\n

All versions of Wget before the patched version of 1.18 are affected.<\/p>\n

1. GNU wget before 1.18 when supplied with a malicious URL (to a malicious or compromised web server) can be tricked into saving an arbitrary remote file supplied by an attacker, with arbitrary contents and file name under the current directory and possibly other directories by writing to .wgetrc.
\n2. Remote code execution and even root privilege escalation if wget is run via a root cronjob as is often the case in many web application deployments.
\n3. Can exploit intercept\/modify the network traffic.<\/p>\n

Due to lack of control in the utility (wget) , downloading a link from a remote server which is controled by an attacker create an arbitrary file
\nwith an arbitrary contents and filename by issuing a crafted HTTP 30X Redirect containing FTP server reference in response to the victim’s wget request.<\/p>\n

ubuntusyn:~\/test\/blog$ wget –version | head -n1
\nGNU Wget 1.15 built on linux-gnu.<\/p><\/blockquote>\n

Solution:<\/strong>
\nUpdate wget to version 1.18<\/p>\n

Patch lists::<\/p>\n

Ubuntu ::<\/p>\n

Ubuntu 12.04 LTS (Precise Pangolin) = released (1.13.4-2ubuntu1.4)
\nUbuntu 14.04 LTS (Trusty Tahr) = released (1.15-1ubuntu1.14.04.2)
\nUbuntu Touch 15.04 = needed
\nUbuntu Core 15.04 = does not exist
\nUbuntu 15.10 (Wily Werewolf) = released (1.16.1-1ubuntu1.1)
\nUbuntu 16.04 LTS (Xenial Xerus) = released (1.17.1-1ubuntu1.1)
\nUbuntu 16.10 (Yakkety Yak) = released (1.17.1-1ubuntu2)<\/p>\n

RedHat::<\/p>\n

Red Hat Enterprise Linux 6 = Will not fix
\nRed Hat Enterprise Linux 7 = Fix deferred
\nRed Hat Enterprise Linux 5 = Will not fix<\/p><\/blockquote>\n

Ubuntu::
\nThe latest wget version is not available in any PPA or repository to install Wget version 1.18.<\/p>\n

Below installation steps will guide you the manual installation process of GNU Wget.<\/p>\n

root@ubuntusyn:\/usr\/local\/src# apt-get update
\nroot@ubuntusyn:\/usr\/local\/src# apt-get build-dep wget<\/p>\n

root@ubuntusyn:\/usr\/local\/src# wget http:\/\/ftp.gnu.org\/gnu\/wget\/wget-1.18.tar.gz<\/p>\n

root@ubuntusyn:\/usr\/local\/src# tar -xvf wget-1.18.tar.gz
\nroot@ubuntusyn:\/usr\/local\/src# cd wget-1.18
\nroot@ubuntusyn:\/usr\/local\/src\/wget-1.18# .\/configure –with-ssl=openssl –prefix=\/opt\/wget
\nroot@ubuntusyn:\/usr\/local\/src\/wget-1.18# make
\nroot@ubuntusyn:\/usr\/local\/src\/wget-1.18# make install<\/p>\n

root@ubuntusyn:\/usr\/local\/src\/wget-1.18# \/opt\/wget\/bin\/wget -V | head -n1
\nGNU Wget 1.18 built on linux-gnu.<\/p>\n

root@ubuntusyn:\/usr\/bin# mv wget wget_v1.15
\nroot@ubuntusyn:\/usr\/bin# ln -s \/opt\/wget\/bin\/wget \/usr\/bin\/wget
\nroot@ubuntusyn:\/usr\/bin# wget -V | head -n1
\nGNU Wget 1.18 built on linux-gnu.<\/p><\/blockquote>\n

<\/div>\n

<\/path><\/svg><\/i> \"Loading\"<\/p>\n

<\/div>\n","protected":false},"excerpt":{"rendered":"

CVE-2016-4971 [Arbitrary File Upload \/ Potential Remote Code Execution] Severity: High below 1.8 version. All versions of Wget before the patched version of 1.18 are affected. 1. GNU wget before 1.18 when supplied with a malicious URL (to a malicious or compromised web server) can be tricked into saving an arbitrary remote file supplied by […]<\/p>\n

<\/div>\n

<\/path><\/svg><\/i> \"Loading\"<\/p>\n

<\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","sfsi_plus_gutenberg_text_before_share":"","sfsi_plus_gutenberg_show_text_before_share":"","sfsi_plus_gutenberg_icon_type":"","sfsi_plus_gutenberg_icon_alignemt":"","sfsi_plus_gutenburg_max_per_row":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-185","post","type-post","status-publish","format-standard","hentry","category-general"],"yoast_head":"\nWget CVE-2016-4971: Arbitrary File Upload<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Wget CVE-2016-4971: Arbitrary File Upload\" \/>\n<meta property=\"og:description\" content=\"CVE-2016-4971 [Arbitrary File Upload \/ Potential Remote Code Execution] Severity: High below 1.8 version. All versions of Wget before the patched version of 1.18 are affected. 1. GNU wget before 1.18 when supplied with a malicious URL (to a malicious or compromised web server) can be tricked into saving an arbitrary remote file supplied by \u2026\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/\" \/>\n<meta property=\"og:site_name\" content=\"Urolime Blogs\" \/>\n<meta property=\"article:published_time\" content=\"2016-07-12T15:59:52+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-09-21T07:29:25+00:00\" \/>\n<meta name=\"author\" content=\"Urolime Technologies\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Urolime Technologies\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/\"},\"author\":{\"name\":\"Urolime Technologies\",\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/#\/schema\/person\/c231f59d5f2c2516e0efc6067ee0c22c\"},\"headline\":\"Wget CVE-2016-4971: Arbitrary File Upload\",\"datePublished\":\"2016-07-12T15:59:52+00:00\",\"dateModified\":\"2021-09-21T07:29:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/\"},\"wordCount\":398,\"publisher\":{\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/#organization\"},\"articleSection\":[\"General\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/\",\"url\":\"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/\",\"name\":\"Wget CVE-2016-4971: Arbitrary File Upload\",\"isPartOf\":{\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/#website\"},\"datePublished\":\"2016-07-12T15:59:52+00:00\",\"dateModified\":\"2021-09-21T07:29:25+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.urolime.com\/blogs\/in\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Wget CVE-2016-4971: Arbitrary File Upload\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/#website\",\"url\":\"https:\/\/www.urolime.com\/blogs\/in\/\",\"name\":\"Urolime Blogs\",\"description\":\"The place for DevOps, Cloud, Kubernetes News and Updates\",\"publisher\":{\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.urolime.com\/blogs\/in\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/#organization\",\"name\":\"Urolime Blogs\",\"url\":\"https:\/\/www.urolime.com\/blogs\/in\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.urolime.com\/blogs\/in\/wp-content\/uploads\/sites\/9\/2021\/06\/cropped-250-x250.jpg\",\"contentUrl\":\"https:\/\/www.urolime.com\/blogs\/in\/wp-content\/uploads\/sites\/9\/2021\/06\/cropped-250-x250.jpg\",\"width\":250,\"height\":73,\"caption\":\"Urolime Blogs\"},\"image\":{\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.urolime.com\/blogs\/in\/#\/schema\/person\/c231f59d5f2c2516e0efc6067ee0c22c\",\"name\":\"Urolime Technologies\",\"description\":\"Urolime Technologies has made groundbreaking accomplishments in the field of Google Cloud & Kubernetes Consulting, DevOps Services, 24\/7 Managed Services & Support, Dedicated IT Team, Managed AWS Consulting and Azure Cloud Consulting. We believe our customers are Smart to choose their IT Partner, and we \u201cDo IT Smart\u201d.\",\"sameAs\":[\"https:\/\/www.urolime.com\/\"],\"url\":\"https:\/\/www.urolime.com\/blogs\/in\/author\/blogadmin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Wget CVE-2016-4971: Arbitrary File Upload","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/","og_locale":"en_US","og_type":"article","og_title":"Wget CVE-2016-4971: Arbitrary File Upload","og_description":"CVE-2016-4971 [Arbitrary File Upload \/ Potential Remote Code Execution] Severity: High below 1.8 version. All versions of Wget before the patched version of 1.18 are affected. 1. GNU wget before 1.18 when supplied with a malicious URL (to a malicious or compromised web server) can be tricked into saving an arbitrary remote file supplied by \u2026","og_url":"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/","og_site_name":"Urolime Blogs","article_published_time":"2016-07-12T15:59:52+00:00","article_modified_time":"2021-09-21T07:29:25+00:00","author":"Urolime Technologies","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Urolime Technologies","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/#article","isPartOf":{"@id":"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/"},"author":{"name":"Urolime Technologies","@id":"https:\/\/www.urolime.com\/blogs\/in\/#\/schema\/person\/c231f59d5f2c2516e0efc6067ee0c22c"},"headline":"Wget CVE-2016-4971: Arbitrary File Upload","datePublished":"2016-07-12T15:59:52+00:00","dateModified":"2021-09-21T07:29:25+00:00","mainEntityOfPage":{"@id":"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/"},"wordCount":398,"publisher":{"@id":"https:\/\/www.urolime.com\/blogs\/in\/#organization"},"articleSection":["General"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/","url":"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/","name":"Wget CVE-2016-4971: Arbitrary File Upload","isPartOf":{"@id":"https:\/\/www.urolime.com\/blogs\/in\/#website"},"datePublished":"2016-07-12T15:59:52+00:00","dateModified":"2021-09-21T07:29:25+00:00","breadcrumb":{"@id":"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.urolime.com\/blogs\/in\/wget-cve-arbitrary-file-upload\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.urolime.com\/blogs\/in\/"},{"@type":"ListItem","position":2,"name":"Wget CVE-2016-4971: Arbitrary File Upload"}]},{"@type":"WebSite","@id":"https:\/\/www.urolime.com\/blogs\/in\/#website","url":"https:\/\/www.urolime.com\/blogs\/in\/","name":"Urolime Blogs","description":"The place for DevOps, Cloud, Kubernetes News and Updates","publisher":{"@id":"https:\/\/www.urolime.com\/blogs\/in\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.urolime.com\/blogs\/in\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.urolime.com\/blogs\/in\/#organization","name":"Urolime Blogs","url":"https:\/\/www.urolime.com\/blogs\/in\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.urolime.com\/blogs\/in\/#\/schema\/logo\/image\/","url":"https:\/\/www.urolime.com\/blogs\/in\/wp-content\/uploads\/sites\/9\/2021\/06\/cropped-250-x250.jpg","contentUrl":"https:\/\/www.urolime.com\/blogs\/in\/wp-content\/uploads\/sites\/9\/2021\/06\/cropped-250-x250.jpg","width":250,"height":73,"caption":"Urolime Blogs"},"image":{"@id":"https:\/\/www.urolime.com\/blogs\/in\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.urolime.com\/blogs\/in\/#\/schema\/person\/c231f59d5f2c2516e0efc6067ee0c22c","name":"Urolime Technologies","description":"Urolime Technologies has made groundbreaking accomplishments in the field of Google Cloud & Kubernetes Consulting, DevOps Services, 24\/7 Managed Services & Support, Dedicated IT Team, Managed AWS Consulting and Azure Cloud Consulting. We believe our customers are Smart to choose their IT Partner, and we \u201cDo IT Smart\u201d.","sameAs":["https:\/\/www.urolime.com\/"],"url":"https:\/\/www.urolime.com\/blogs\/in\/author\/blogadmin\/"}]}},"_links":{"self":[{"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/posts\/185","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/comments?post=185"}],"version-history":[{"count":5,"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/posts\/185\/revisions"}],"predecessor-version":[{"id":2444,"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/posts\/185\/revisions\/2444"}],"wp:attachment":[{"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/media?parent=185"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/categories?post=185"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.urolime.com\/blogs\/in\/wp-json\/wp\/v2\/tags?post=185"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}