Denial of Service in GNU wget via FTP OPIE Authentication

Executive Summary

GNU wget is vulnerable to denial of service via its FTP OPIE/S-KEY authentication. A malicious FTP server or network attacker can send a crafted challenge with a very high sequence number, forcing wget to perform up to 2.1 billion MD5 computations. This causes excessive CPU usage and temporary program suspension.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusual CPU usage spikes during FTP operations, especially when using OPIE/S-KEY authentication. Check wget logs for failed FTP authentication attempts with large sequence numbers. Use network monitoring tools to inspect FTP traffic for crafted OPIE challenges containing abnormally high sequence numbers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause your system to slow down or become unresponsive when connecting to a malicious FTP server. It may lead to temporary denial of service as wget consumes excessive CPU resources during authentication attempts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it is a denial-of-service issue in FTP authentication. However, excessive CPU usage from exploitation could disrupt system availability, potentially affecting service continuity required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update wget to the latest patched version. Disable FTP OPIE/S-KEY authentication if not required. Use SFTP or FTPS instead of FTP. Apply network-level controls to block or monitor suspicious FTP traffic. Temporarily restrict FTP server access until patched.

Useful 0 Not Useful 0