Debian 安全報告

DSA-1904-1 wget -- 輸入驗證不足

報告日期:
2009/10/09
受影響的軟體:
wget
可被襲擊:
參考的安全性資料庫:
在 Debian 臭蟲追蹤系統中: 臭蟲 549293.
在 Mitre's CVE 的目錄中: CVE-2009-3490.
更詳盡的資訊:

Daniel Stenberg 發現 wget,一個使用 HTTP(S) 與 FTP 從網站取回檔案的網路實用工具,很容易受到「Null Prefix Attacks Against SSL/TLS Certificates」弱點攻擊,這個弱點已在 Blackhat conference 發表了一段時間。這允許攻擊者經由精心製作,在 Common Name 欄位注入空位元組 (null byte) 的 ITU-T X.509 憑證,執行不被注意的中間人攻擊 (man-in-the-middle attacks)。

對於 oldstable distribution (etch),這個問題已在 1.10.2-2+etch1 版被修正。

對於 stable distribution (lenny),這個問題已在 1.11.4-2+lenny1 版被修正。

對於 testing distribution (squeeze),這問題很快會被修正。

對於 unstable distribution (sid),這個問題已在 1.12-1 版被修正。

我們建議你升級你的 wget 套件。

修改於:

Debian GNU/Linux 4.0 (etch)

來源:
http://security.debian.org/pool/updates/main/w/wget/wget_1.10.2-2+etch1.diff.gz
http://security.debian.org/pool/updates/main/w/wget/wget_1.10.2.orig.tar.gz
http://security.debian.org/pool/updates/main/w/wget/wget_1.10.2-2+etch1.dsc
Alpha:
http://security.debian.org/pool/updates/main/w/wget/wget_1.10.2-2+etch1_alpha.deb
AMD64:
http://security.debian.org/pool/updates/main/w/wget/wget_1.10.2-2+etch1_amd64.deb
ARM:
http://security.debian.org/pool/updates/main/w/wget/wget_1.10.2-2+etch1_arm.deb
HP Precision:
http://security.debian.org/pool/updates/main/w/wget/wget_1.10.2-2+etch1_hppa.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/w/wget/wget_1.10.2-2+etch1_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/w/wget/wget_1.10.2-2+etch1_ia64.deb
Little-endian MIPS:
http://security.debian.org/pool/updates/main/w/wget/wget_1.10.2-2+etch1_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/w/wget/wget_1.10.2-2+etch1_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/w/wget/wget_1.10.2-2+etch1_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/w/wget/wget_1.10.2-2+etch1_sparc.deb

Debian GNU/Linux 5.0 (lenny)

來源:
http://security.debian.org/pool/updates/main/w/wget/wget_1.11.4-2+lenny1.dsc
http://security.debian.org/pool/updates/main/w/wget/wget_1.11.4.orig.tar.gz
http://security.debian.org/pool/updates/main/w/wget/wget_1.11.4-2+lenny1.diff.gz
Alpha:
http://security.debian.org/pool/updates/main/w/wget/wget_1.11.4-2+lenny1_alpha.deb
AMD64:
http://security.debian.org/pool/updates/main/w/wget/wget_1.11.4-2+lenny1_amd64.deb
ARM:
http://security.debian.org/pool/updates/main/w/wget/wget_1.11.4-2+lenny1_arm.deb
ARM EABI:
http://security.debian.org/pool/updates/main/w/wget/wget_1.11.4-2+lenny1_armel.deb
HP Precision:
http://security.debian.org/pool/updates/main/w/wget/wget_1.11.4-2+lenny1_hppa.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/w/wget/wget_1.11.4-2+lenny1_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/w/wget/wget_1.11.4-2+lenny1_ia64.deb
Big-endian MIPS:
http://security.debian.org/pool/updates/main/w/wget/wget_1.11.4-2+lenny1_mips.deb
Little-endian MIPS:
http://security.debian.org/pool/updates/main/w/wget/wget_1.11.4-2+lenny1_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/w/wget/wget_1.11.4-2+lenny1_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/w/wget/wget_1.11.4-2+lenny1_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/w/wget/wget_1.11.4-2+lenny1_sparc.deb

列出的檔案的 MD5 檢查可以由 original advisory 取得。