GNU Wget CVE-2016-7098 Security Bypass Vulnerability

GNU Wget is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass the security mechanism and perform unauthorized actions.

Information

Bugtraq ID: 93157
Class: Design Error
CVE: CVE-2016-7098

Remote: Yes
Local: No
Published: Sep 26 2016 12:00AM
Updated: Nov 01 2017 12:05AM
Credit: The vendor reported this issue.
Vulnerable: Ubuntu Ubuntu Linux 17.10
Ubuntu Ubuntu Linux 17.04
Ubuntu Ubuntu Linux 16.04 LTS
Ubuntu Ubuntu Linux 14.04 LTS
GNU wget 1.11.4
GNU wget 1.11.3
GNU wget 1.11.2
GNU wget 1.11.1
GNU wget 1.10.2
GNU wget 1.10.1
GNU wget 1.10
GNU wget 1.9.1
GNU wget 1.9
GNU wget 1.8.2
GNU wget 1.8.1
GNU wget 1.8
GNU wget 1.7.1
GNU wget 1.7
GNU wget 1.6
GNU wget 1.5.3
GNU wget 1.17
GNU wget 1.16
GNU wget 1.15
GNU wget 1.12
GNU wget 1.11

Not Vulnerable:

Exploit

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

References:

Re: CVE Request - Gnu Wget 1.17 - Design Error Vulnerability (Seclists.org)
GNU Wget Homepage (GNU)
Bug 1328137 - (CVE-2016-7098) CVE-2016-7098 wget: files rejected by access list (Red Hat)

Source: www.securityfocus.com

Exploit Collector

Search Exploit