Open-source devs: Wget off your bloated festive behinds and patch this user cred-blabbing bug

New year, new CVE


Happy New Year! Oh, and if you include GNU's wget utility in software you write, pull down the new version released on Boxing Day and push out updates to your users.

The popular utility retrieves internet-hosted HTTP/HTTPS and FTP/FTPS content and some years ago began storing extended attributes on disk as URIs.

On Christmas Day, security researcher Gynvael Coldwind (@gynvael) noted on Twitter that the stored attributes can include user credentials:

Though only stored locally, user IDs and passwords weren't protected, and as Hanno Böck pointed out on the OSS-Sec mailing list, URLs can even contain "secret tokens" used for external services like file hosting.

"The URL of downloads gets stored via filesystem attributes on systems that support Unix extended attributes," Böck wrote, and they were easily accessible on any logged-in machine using the getfattr command.

The bug has been designated CVE-2018-20483 and could be present in other systems as noted by the Mitre entry. "This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl."

Böck said the same behaviour has been reported to the Chrome team and is awaiting a fix. Hector Martin tweeted that the stored information survives being moved to a different filesystem, so someone wanting to steal stored URLs from can move it from the target's hard drive to a USB key with no trouble.

Wget dev Tim Rühsen wrote that the utility stopped using xattrs by default in the newly issued version 1.20.1. ®

Similar topics

Narrower topics


Other stories you might like

  • VMware patches critical guest-to-host vulnerabilities
    Time to fix code like it's 2020

    In an advisory this week, VMware alerted users to guest-to-host vulnerabilities in the XHCI and UHCI USB controllers in its ESXi hypervisor, plus an important flaw fixed in NSX Data Center for vSphere.

    In all, five vulnerabilities were discovered in VMware's ESXi, Workstation, Cloud Foundation (ESXi), and Fusion during the Tianfu Cup 2021, a Chinese vulnerability competition, by the country's Kunlun Lab. Bugs that Kunlun discovered were disclosed privately to VMware – though last year China passed a new law ordering security researchers to reveal findings to the country's Ministry of Public Security at least two days before anyone else.

    The vendor said it hadn't seen any evidence the competition's findings had been exploited in the wild. Patches have been issued, now it's up to admins to schedule them. The vulnerabilities range from use-after-free() and double-fetch flaws that can be exploited to execute code on the host, to an old-fashioned denial of service (DoS). The full list for ESXi, Workstation, Cloud Foundation, and Fusion is:

    Continue reading
  • Microsoft patches Y2K-like bug that borked on-prem Exchange Server
    Happy New Year. Welcome back! Now apply this patch – which Microsoft warns isn't easy – if you want email to work

    Microsoft has kicked off 2022 by issuing a patch for Exchange Server 2016 and 2019, which both possessed a “latent date issue” that saw emails queued up instead of being dispatched to inboxes.

    “The problem relates to a date check failure with the change of the new year,” states a January 1st post to the Exchange Blog.

    Exchange’s malware scanning engine is the source of the problem, as Exchange checks the version of that software and then tries to write the date into a variable. But that variable’s maximum value is 2,147,483,647 and the value Exchange tries to write - 2,201,010,001, to reflect the date of January 1st, 2022, at midnight – exceeds the variable’s maximum threshold.

    Continue reading
  • Patch now? Why enterprise exploits are still partying like it's 1999
    Am I only dreaming, or is this burning an Eternal Blue?

    Feature Some vulnerabilities remain unreported for the longest time. The 12-year-old Dell SupportAssist remote code execution (RCE) flaw – which was finally unearthed earlier this year – would be one example.

    Others, however, have not only been long since reported and had patches released, but continue to pose a threat to enterprises. A joint advisory from the National Cyber Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA), published in late July, listed the top 30 publicly known vulnerabilities that are routinely being exploited by threat actors. Many of these are a good few years old, including one Microsoft Office RCE that was patched in 2017 but had been around since the year 2000.

    Eoin Keary, CEO and founder of Edgescan, told The Register that the oldest common vulnerability discovered in its latest quarterly vulnerability scans report (CVE-1999-0517, impacting Simple Network Management Protocol) dated back to 1999. Which raises the question, why are threat actors being allowed to party like it's, um... 1999?

    Continue reading

Biting the hand that feeds IT © 1998–2022