CVE-2004-1488 Command injection in n/a
Remote attackers can execute arbitrary code by sending malicious terminal escape sequences in HTTP responses to users running wget.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2004-1488?
CVE-2004-1488 is a medium-severity command injection vulnerability in n/a, published on 15 Feb 2005. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code.
Which versions are affected by CVE-2004-1488?
It affects 1 product.
Products include Gnu Wget.
How do I fix CVE-2004-1488?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2004-1488 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2004-1488 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2004-1488, GHSA-xrhg-fh2g-fpxj.