PublicDateAtUSN: 2017-10-26 15:00:00
Candidate: CVE-2017-13089
CRD: 2017-10-26 15:00:00
PublicDate: 2017-10-27 19:29:00 UTC
References: 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13089
 https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.html
 https://ubuntu.com/security/notices/USN-3464-1
 https://ubuntu.com/security/notices/USN-3464-2
Description:
 The http.c:skip_short_body() function is called in some circumstances, such
 as when processing redirects. When the response is sent chunked in wget
 before 1.19.2, the chunk parser uses strtol() to read each chunk's length,
 but doesn't check that the chunk length is a non-negative number. The code
 then tries to skip the chunk in pieces of 512 bytes by using the MIN()
 macro, but ends up passing the negative chunk length to
 connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits
 of the chunk length are discarded, leaving fd_read() with a completely
 attacker controlled length argument.
Ubuntu-Description: 
Notes: 
Bugs: 
Priority: medium
Discovered-by: Antti Levomäki, Christian Jalio, and Joonas Pihlaja
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H [8.8 HIGH]


Patches_wget:
 upstream: http://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734ea5125770989c215df3f
upstream_wget: needs-triage
precise/esm_wget: released (1.13.4-2ubuntu1.5)
trusty_wget: released (1.15-1ubuntu1.14.04.3)
trusty/esm_wget: released (1.15-1ubuntu1.14.04.3)
xenial_wget: released (1.17.1-1ubuntu1.3)
esm-infra/xenial_wget: released (1.17.1-1ubuntu1.3)
zesty_wget: released (1.18-2ubuntu1.1)
artful_wget: released (1.19.1-3ubuntu1.1)
devel_wget: released (1.19.1-3ubuntu1.1)