SunOS 5.10: wget patch.
Date this patch was last updated by Sun : Oct/14/19

The remote host is affected by the vulnerability described in GLSA-200910-01 (Wget: Certificate validation error)

    The vendor reported that Wget does not properly handle Common Name (CN)     fields in X.509 certificates that contain an ASCII NUL (\\0) character.
    Specifically, the processing of such fields is stopped at the first     occurrence of a NUL character. This type of vulnerability was recently     discovered by Dan Kaminsky and Moxie Marlinspike.
  Impact :

    A remote attacker might employ a specially crafted X.509 certificate,     containing a NUL character in the Common Name field to conduct     man-in-the-middle attacks on SSL connections made using Wget.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 4 / 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2009:1549 advisory.

  - wget: incorrect verification of SSL certificate with NUL in name (CVE-2009-3490)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- Wed Nov 18 2009 Karsten Hopp <karsten at redhat.com>     1.12-2

    - don't provide /usr/share/info/dir

    - Tue Nov 17 2009 Karsten Hopp <karsten at redhat.com>       1.12-1

    - update to wget-1.12

    - fixes CVE-2009-3490 wget: incorrect verification of       SSL certificate with NUL in name

  - Fri Aug 21 2009 Tomas Mraz <tmraz at redhat.com> -     1.11.4-5

    - rebuilt with new openssl

    - Mon Jul 27 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.11.4-4

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

    - Wed Feb 25 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.11.4-3

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Sun Jan 18 2009 Tomas Mraz <tmraz at redhat.com>       1.11.4-2

    - rebuild with new openssl

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Nov 18 2009 Karsten Hopp <karsten at redhat.com>     1.12-2

    - don't provide /usr/share/info/dir

    - Tue Nov 17 2009 Karsten Hopp <karsten at redhat.com>       1.12-1

    - update to wget-1.12

    - fixes CVE-2009-3490 wget: incorrect verification of       SSL certificate with NUL in name

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Daniel Stenberg discovered that wget, a network utility to retrieve files from the Web using HTTP(S) and FTP, is vulnerable to the 'Null Prefix Attacks Against SSL/TLS Certificates' published at the Blackhat conference some time ago. This allows an attacker to perform undetected man-in-the-middle attacks via a crafted ITU-T X.509 certificate with an injected null byte in the Common Name field.

SunOS 5.10_x86: wget patch.
Date this patch was last updated by Sun : Oct/14/19

SunOS 5.10_x86: wget patch.
Date this patch was last updated by Sun : Sep/15/16

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
129871	Solaris 10 (sparc) : 125215-08	Nessus	Solaris Local Security Checks	2019/10/15	2020/1/7	medium
42197	GLSA-200910-01 : Wget: Certificate validation error	Nessus	Gentoo Local Security Checks	2009/10/22	2021/1/6	medium
42359	RHEL 4 / 5 : wget (RHSA-2009:1549)	Nessus	Red Hat Local Security Checks	2009/11/4	2024/4/21	critical
42986	Fedora 10 : wget-1.12-2.fc10 (2009-11739)	Nessus	Fedora Local Security Checks	2009/12/3	2021/1/11	medium
42988	Fedora 12 : wget-1.12-2.fc12 (2009-11836)	Nessus	Fedora Local Security Checks	2009/12/3	2021/1/11	medium
44769	Debian DSA-1904-1 : wget - insufficient input validation	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	medium
129875	Solaris 10 (x86) : 125216-08	Nessus	Solaris Local Security Checks	2019/10/15	2020/1/7	medium
107924	Solaris 10 (x86) : 125216-07	Nessus	Solaris Local Security Checks	2018/3/12	2025/10/23	medium

检测

插件搜索

medium

medium

critical

medium

medium

medium

medium

medium