CVE-2016-4971 : GNU wget before 1.18 allows remote servers to write to arbitrary files by redire

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

Published 2016-06-30 17:59:08

Updated 2025-04-12 10:46:41

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2016-4971

GNU » Wget
Versions before (<) 1.18
cpe:2.3:a:gnu:wget:*:*:*:*:*:*:*:*
Matching versions
Oracle » Solaris » Version: 10
cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*
Matching versions
Oracle » Solaris » Version: 11.3
cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 12.04
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 15.10
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Matching versions
Paloaltonetworks » Pan-os
Versions from including (>=) 7.0.0 and up to, including, (<=) 7.0.14
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
Matching versions
Paloaltonetworks » Pan-os
Versions from including (>=) 6.1.0 and up to, including, (<=) 6.1.16
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
Matching versions
Paloaltonetworks » Pan-os
Versions from including (>=) 7.1.0 and up to, including, (<=) 7.1.9
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2016-4971

EPSS FAQ

73.29%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-4971

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2016-4971

https://security.paloaltonetworks.com/CVE-2016-4971

CVE-2016-4971 WGET Vulnerability
Third Party Advisory
https://www.exploit-db.com/exploits/40064/

GNU Wget < 1.18 - Arbitrary File Upload / Remote Code Execution
Exploit;Third Party Advisory;VDB Entry
http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Oracle Solaris Bulletin - July 2016
Third Party Advisory

CVEs referencing this url
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=e996e322ffd42aaa051602da182d03178d0f13e1

wget.git - GNU Wget
Patch;Vendor Advisory
https://security.gentoo.org/glsa/201610-11

GNU Wget: Multiple vulnerabilities (GLSA 201610-11) — Gentoo security
Third Party Advisory
http://www.securitytracker.com/id/1036133

wget HTTP Redirect Bug Lets Remote Users Write Files on the Target System - SecurityTracker
Third Party Advisory;VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1343666

1343666 – (CVE-2016-4971) CVE-2016-4971 wget: Lack of filename checking allows arbitrary file upload via FTP redirect
Exploit;Issue Tracking;Patch;Third Party Advisory
http://packetstormsecurity.com/files/162395/GNU-wget-Arbitrary-File-Upload-Code-Execution.html

GNU wget Arbitrary File Upload / Code Execution ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
http://www.securityfocus.com/bid/91530

GNU Wget CVE-2016-4971 Arbitrary File Overwrite Vulnerability
Third Party Advisory;VDB Entry
http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html

GNU wget 1.18 released
Mailing List;Patch;Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2016-08/msg00043.html

openSUSE-SU-2016:2027-1: moderate: Security update for wget
Broken Link
http://www.ubuntu.com/usn/USN-3012-1

USN-3012-1: Wget vulnerability | Ubuntu security notices
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2587.html

RHSA-2016:2587 - Security Advisory - Red Hat Customer Portal
Broken Link

Jump to

Vulnerability Details : CVE-2016-4971

Products affected by CVE-2016-4971

Exploit prediction scoring system (EPSS) score for CVE-2016-4971

CVSS scores for CVE-2016-4971

References for CVE-2016-4971