Oh no, you're thinking, yet another cookie pop-up. Well, sorry, it's the law. We measure how many people read us, and ensure you see relevant ads, by storing cookies on your device. If you're cool with that, hit “Accept all Cookies”. For more info and to customize your settings, hit “Customize Settings”.

Review and manage your consent

Here's an overview of our use of cookies, similar technologies and how to manage them. You can also change your choices at any time, by hitting the “Your Consent Options” link on the site's footer.

Manage Cookie Preferences
  • These cookies are strictly necessary so that you can navigate the site as normal and use all features. Without these cookies we cannot provide you with the service that you expect.

  • These cookies are used to make advertising messages more relevant to you. They perform functions like preventing the same ad from continuously reappearing, ensuring that ads are properly displayed for advertisers, and in some cases selecting advertisements that are based on your interests.

  • These cookies collect information in aggregate form to help us understand how our websites are being used. They allow us to count visits and traffic sources so that we can measure and improve the performance of our sites. If people say no to these cookies, we do not know how many people have visited and we cannot monitor performance.

See also our Cookie policy and Privacy policy.

This article is more than 1 year old

Open-source devs: Wget off your bloated festive behinds and patch this user cred-blabbing bug

New year, new CVE

Happy New Year! Oh, and if you include GNU's wget utility in software you write, pull down the new version released on Boxing Day and push out updates to your users.

The popular utility retrieves internet-hosted HTTP/HTTPS and FTP/FTPS content and some years ago began storing extended attributes on disk as URIs.

On Christmas Day, security researcher Gynvael Coldwind (@gynvael) noted on Twitter that the stored attributes can include user credentials:

Though only stored locally, user IDs and passwords weren't protected, and as Hanno Böck pointed out on the OSS-Sec mailing list, URLs can even contain "secret tokens" used for external services like file hosting.

"The URL of downloads gets stored via filesystem attributes on systems that support Unix extended attributes," Böck wrote, and they were easily accessible on any logged-in machine using the getfattr command.

The bug has been designated CVE-2018-20483 and could be present in other systems as noted by the Mitre entry. "This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl."

Böck said the same behaviour has been reported to the Chrome team and is awaiting a fix. Hector Martin tweeted that the stored information survives being moved to a different filesystem, so someone wanting to steal stored URLs from can move it from the target's hard drive to a USB key with no trouble.

Wget dev Tim Rühsen wrote that the utility stopped using xattrs by default in the newly issued version 1.20.1. ®

 

Similar topics

Similar topics

Similar topics

TIP US OFF

Send us news


Other stories you might like