SunOS 5.10_x86: wget patch.
Date this patch was last updated by Sun : Jan/19/15

SunOS 5.10: wget patch.
Date this patch was last updated by Sun : Jan/19/15

SunOS 5.10: wget patch.
Date this patch was last updated by Sun : Apr/15/11

SunOS 5.10_x86: wget patch.
Date this patch was last updated by Sun : Apr/15/11

The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2009-420:01 advisory.

    GNU Wget is a file retrieval utility which can use either the HTTP or FTP protocols. Wget features include     the ability to work in the background while you are logged out, recursive retrieval of directories, file     name wildcard matching, remote file timestamp storage and comparison, use of Rest with FTP servers and     Range with HTTP servers to retrieve files over slow or unstable connections, support for Proxy servers,     and configurability.
    Security bugs fixed with this release:
    CVE-2009-3490     GNU Wget before 1.12 does not properly handle a '0' character in a domain name in the Common Name field of     an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a     crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

CVE-2009-3490 wget: incorrect verification of SSL certificate with NUL in name

Daniel Stenberg reported that Wget is affected by the previously published 'null prefix attack', caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse Wget into accepting it by mistake. (CVE-2009-3490)

An updated wget package that fixes a security issue is now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GNU Wget is a file retrieval utility that can use HTTP, HTTPS, and FTP.

Daniel Stenberg reported that Wget is affected by the previously published 'null prefix attack', caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse Wget into accepting it by mistake. (CVE-2009-3490)

Wget users should upgrade to this updated package, which contains a backported patch to correct this issue.

A vulnerability has been found and corrected in wget :

GNU Wget before 1.12 does not properly handle a '&#0;' (NUL) character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408 (CVE-2009-3490).

This update provides a solution to this vulnerability.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

ID	名稱	產品	系列	已發布	已更新	嚴重性
107923	Solaris 10 (x86) : 125216-05	Nessus	Solaris Local Security Checks	2018/3/12	2025/10/23	medium
107421	Solaris 10 (sparc) : 125215-05	Nessus	Solaris Local Security Checks	2018/3/12	2025/10/24	medium
107420	Solaris 10 (sparc) : 125215-04	Nessus	Solaris Local Security Checks	2018/3/12	2025/10/24	medium
107922	Solaris 10 (x86) : 125216-04	Nessus	Solaris Local Security Checks	2018/3/12	2025/10/23	medium
291426	MiracleLinux 3 : wget-1.11.4-2.1.1AXS3 (AXSA:2009-420:01)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	critical
60690	Scientific Linux Security Update : wget on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
67069	CentOS 3 / 4 / 5 : wget (CESA-2009:1549)	Nessus	CentOS Local Security Checks	2013/6/29	2021/1/4	medium
40638	Mandriva Linux Security Advisory : wget (MDVSA-2009:206-1)	Nessus	Mandriva Local Security Checks	2009/8/20	2021/1/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

critical

medium

medium

medium