NVD

Id
32775  
Name
CVE-2014-4877  
Description
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-30  
Published
2014-10-29  
Modified Date
2017-01-25  
Seq
2014-4877  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
172266 32775 CVE-2014-4877 http://advisories.mageia.org/MGASA-2014-0431.html  View
172267 32775 CVE-2014-4877 http://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7  View
172268 32775 CVE-2014-4877 http://git.savannah.gnu.org/cgit/wget.git/commit/?id=b4440d96cf8173d68ecaa07c36b8f4316ee794d0  View
172269 32775 CVE-2014-4877 [bug-wget] 20141027 GNU wget 1.16 released  View
172270 32775 CVE-2014-4877 SUSE-SU-2014:1366  View
172271 32775 CVE-2014-4877 SUSE-SU-2014:1408  View
172272 32775 CVE-2014-4877 openSUSE-SU-2014:1380  View
172273 32775 CVE-2014-4877 RHSA-2014:1764  View
172274 32775 CVE-2014-4877 RHSA-2014:1955  View
172275 32775 CVE-2014-4877 GLSA-201411-05  View
172276 32775 CVE-2014-4877 DSA-3062  View
172277 32775 CVE-2014-4877 VU#685996  View
172278 32775 CVE-2014-4877 MDVSA-2015:121  View
172279 32775 CVE-2014-4877 http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html  View
172280 32775 CVE-2014-4877 USN-2393-1  View
172281 32775 CVE-2014-4877 https://bugzilla.redhat.com/show_bug.cgi?id=1139181  View
172282 32775 CVE-2014-4877 https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access  View
172283 32775 CVE-2014-4877 https://github.com/rapid7/metasploit-framework/pull/4088  View
172284 32775 CVE-2014-4877 https://kc.mcafee.com/corporate/index?page=content&id=SB10106  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
16258 JVNDB-2014-005133 GNU Wget にシンボリックリンクの扱いに関する問題 GNU Wget には、FTP の再帰的ダウンロード時におけるシンボリックリンクの扱いに問題があり、GNU Wget の実行権限の範囲内でローカルファイルシステム上の任意のファイルを操作される可能性があります。 CVE-2014-4877 72166 CVE-2014-4877 32775 5.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005133.html 2014-10-28 2015-01-30 View