TITLE:
Red Hat update for wget

SECUNIA ADVISORY ID:
SA16984

VERIFY ADVISORY:
http://secunia.com/advisories/16984/

CRITICAL:
Not critical

IMPACT:
Privilege escalation

WHERE:
Local system

OPERATING SYSTEM:
RedHat Linux Advanced Workstation 2.1 for Itanium
http://secunia.com/product/1326/
RedHat Enterprise Linux WS 4
http://secunia.com/product/4670/
RedHat Enterprise Linux WS 3
http://secunia.com/product/2536/
RedHat Enterprise Linux WS 2.1
http://secunia.com/product/1044/
RedHat Enterprise Linux ES 4
http://secunia.com/product/4668/
RedHat Enterprise Linux ES 3
http://secunia.com/product/2535/
RedHat Enterprise Linux ES 2.1
http://secunia.com/product/1306/
RedHat Enterprise Linux AS 4
http://secunia.com/product/4669/
RedHat Enterprise Linux AS 3
http://secunia.com/product/2534/
RedHat Enterprise Linux AS 2.1
http://secunia.com/product/48/

DESCRIPTION:
Red Hat has issued an update for wget. This fixes a vulnerability,
which can be exploited by malicious, local users to perform certain
actions on a vulnerable system with escalated privileges.

The vulnerability is caused due to a race condition when creating
files that are downloaded using wget. The problem is that there is a
time gap between the check is made to determine whether a local file
exists and the time that the file is created. This can be exploited
via symlink attacks to overwrite arbitrary files with the privileges
of the user running the vulnerable program.

Successful exploitation requires write permissions to the directory,
which wget creates the downloaded file in.

Note: A bug in the handling of hostnames containing the ".."
characters, and another in the handling of server replies containing
terminal escape sequences, have also been fixed.

SOLUTION:
Updated packages are available from Red Hat Network.
http://rhn.redhat.com/

ORIGINAL ADVISORY:
http://rhn.redhat.com/errata/RHSA-2005-771.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------