| Severity : |
Medium
|
| Published : |
2010-07-06
|
| Modified : |
2010-07-07
|
| Base Score : |
6.8
|
| Details : |
GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
|
| Product/Version : |
Pro 4.x
CGE 4.x
Mobilinux 4.x
Carrier Grade CGE 6.0
CGE 5.x
Mobilinux 5.x
|
|
