The remote Redhat Enterprise Linux 4 / 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2009:1549 advisory.

  - wget: incorrect verification of SSL certificate with NUL in name (CVE-2009-3490)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Daniel Stenberg discovered that wget, a network utility to retrieve files from the Web using HTTP(S) and FTP, is vulnerable to the 'Null Prefix Attacks Against SSL/TLS Certificates' published at the Blackhat conference some time ago. This allows an attacker to perform undetected man-in-the-middle attacks via a crafted ITU-T X.509 certificate with an injected null byte in the Common Name field.

- Wed Nov 18 2009 Karsten Hopp <karsten at redhat.com>     1.12-2

    - don't provide /usr/share/info/dir

    - Tue Nov 17 2009 Karsten Hopp <karsten at redhat.com>       1.12-1

    - update to wget-1.12

    - fixes CVE-2009-3490 wget: incorrect verification of       SSL certificate with NUL in name

  - Fri Aug 21 2009 Tomas Mraz <tmraz at redhat.com> -     1.11.4-5

    - rebuilt with new openssl

    - Mon Jul 27 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.11.4-4

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

    - Wed Feb 25 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.11.4-3

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Sun Jan 18 2009 Tomas Mraz <tmraz at redhat.com>       1.11.4-2

    - rebuild with new openssl

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Nov 18 2009 Karsten Hopp <karsten at redhat.com>     1.12-2

    - don't provide /usr/share/info/dir

    - Tue Nov 17 2009 Karsten Hopp <karsten at redhat.com>       1.12-1

    - update to wget-1.12

    - fixes CVE-2009-3490 wget: incorrect verification of       SSL certificate with NUL in name

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

SunOS 5.10: wget patch.
Date this patch was last updated by Sun : Sep/15/16

- Wed Nov 18 2009 Karsten Hopp <karsten at redhat.com>     1.12-2

    - don't provide /usr/share/info/dir

    - Tue Nov 17 2009 Karsten Hopp <karsten at redhat.com>       1.12-1

    - update to wget-1.12

    - fixes CVE-2009-3490 wget: incorrect verification of       SSL certificate with NUL in name

  - Fri Aug 21 2009 Tomas Mraz <tmraz at redhat.com> -     1.11.4-5

    - rebuilt with new openssl

    - Mon Jul 27 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 1.11.4-4

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Wget did not correctly handle SSL certificates with zero bytes in the Common Name. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2009-1549 advisory.

    [1.11.4-3]
    - add fix for CVE-2009-3490,       incorrect verification of SSL certificate with NUL in name

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
42359	RHEL 4 / 5 : wget (RHSA-2009:1549)	Nessus	Red Hat Local Security Checks	2009/11/4	2024/4/21	critical
44769	Debian DSA-1904-1 : wget - insufficient input validation	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	medium
42986	Fedora 10 : wget-1.12-2.fc10 (2009-11739)	Nessus	Fedora Local Security Checks	2009/12/3	2021/1/11	medium
42988	Fedora 12 : wget-1.12-2.fc12 (2009-11836)	Nessus	Fedora Local Security Checks	2009/12/3	2021/1/11	medium
107422	Solaris 10 (sparc) : 125215-07	Nessus	Solaris Local Security Checks	2018/3/12	2025/10/24	medium
42987	Fedora 11 : wget-1.12-2.fc11 (2009-11740)	Nessus	Fedora Local Security Checks	2009/12/3	2021/1/11	medium
42050	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : wget vulnerability (USN-842-1)	Nessus	Ubuntu Local Security Checks	2009/10/7	2021/1/19	medium
67954	Oracle Linux 5 : wget (ELSA-2009-1549)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	critical

检测

插件搜索

critical

medium

medium

medium

medium

medium

medium

critical