SB2017011815 - Resource management error in busybox (Alpine package)
Published: January 18, 2017
Security Bulletin ID
SB2017011815
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Resource management error (CVE-ID: CVE-2016-6301)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.
Remediation
Install update from vendor's website.
References
- https://git.alpinelinux.org/aports/commit/?id=94b1464e97c7dd5528f9113c2bc76456076310e4
- https://git.alpinelinux.org/aports/commit/?id=fa4e94214b55d8cc87329df0622fbab8db1f720c
- https://git.alpinelinux.org/aports/commit/?id=1a3429764d88d4b178f1002b87b9599f09ef960a
- https://git.alpinelinux.org/aports/commit/?id=aa0e78b591f5cda199ecb44555f518e0ff6b847c
- https://git.alpinelinux.org/aports/commit/?id=e616b1654ebcdfb83285f27a6eb3639ac35cdb0a