wget prior to 1.16 allows for a web server to write arbitrary files on the clientside

[grandpaflo]

wget prior to 1.16 allows for a web server to write arbitrary files on the client side.

##

A Metasploit module is available for testing:

https://github.com/rapid7/metasploit-framework/pull/4088

the disclosure is here:

https://community.rapid7.com/commun...-wget-ftp-symlink-arbitrary-filesystem-access

Redhat's bug is here:

https://bugzilla.redhat.com/show_bug.cgi?id=1139181

 

[grandpaflo]

Vulnerability Note VU#685996 (kb.cert.org):

http://www.kb.cert.org/vuls/id/685996