openEuler update for busybox



Published: 2021-12-03
Risk Low
Patch available YES
Number of vulnerabilities 8
CVE-ID CVE-2021-42382
CVE-2021-42381
CVE-2021-42380
CVE-2021-42385
CVE-2021-42378
CVE-2021-42379
CVE-2021-42383
CVE-2021-42384
CWE-ID CWE-416
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		openEuler
Operating systems & Components / Operating system

busybox-debugsource
Operating systems & Components / Operating system package or component

busybox-debuginfo
Operating systems & Components / Operating system package or component

busybox-petitboot
Operating systems & Components / Operating system package or component

busybox-help
Operating systems & Components / Operating system package or component

busybox
Operating systems & Components / Operating system package or component

Vendor openEuler

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) Use-after-free

EUVDB-ID: #VU58684

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-42382

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the "getvar_s" function. A remote administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP2

busybox-debugsource: before 1.31.1-13

busybox-debuginfo: before 1.31.1-13

busybox-petitboot: before 1.31.1-13

busybox-help: before 1.31.1-13

busybox: before 1.31.1-13

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1449


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU58673

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-42381

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the "hash_init" function. A remote administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP2

busybox-debugsource: before 1.31.1-13

busybox-debuginfo: before 1.31.1-13

busybox-petitboot: before 1.31.1-13

busybox-help: before 1.31.1-13

busybox: before 1.31.1-13

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1449


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU58694

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-42380

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the "next_input_file" function. A remote administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP2

busybox-debugsource: before 1.31.1-13

busybox-debuginfo: before 1.31.1-13

busybox-petitboot: before 1.31.1-13

busybox-help: before 1.31.1-13

busybox: before 1.31.1-13

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1449


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use-after-free

EUVDB-ID: #VU58683

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-42385

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the "evaluate" function. A remote administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP2

busybox-debugsource: before 1.31.1-13

busybox-debuginfo: before 1.31.1-13

busybox-petitboot: before 1.31.1-13

busybox-help: before 1.31.1-13

busybox: before 1.31.1-13

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1449


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

EUVDB-ID: #VU58680

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-42378

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the "getvar_i" function. A remote administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP2

busybox-debugsource: before 1.31.1-13

busybox-debuginfo: before 1.31.1-13

busybox-petitboot: before 1.31.1-13

busybox-help: before 1.31.1-13

busybox: before 1.31.1-13

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1449


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

EUVDB-ID: #VU58692

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-42379

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the "next_input_file" function. A remote administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP2

busybox-debugsource: before 1.31.1-13

busybox-debuginfo: before 1.31.1-13

busybox-petitboot: before 1.31.1-13

busybox-help: before 1.31.1-13

busybox: before 1.31.1-13

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1449


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

EUVDB-ID: #VU69654

Risk: Low

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-42383

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the awk applet. A remote privileged user can pass a specially crafted input to the application, trigger a use-after-free error and execute arbitrary code.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP2

busybox-debugsource: before 1.31.1-13

busybox-debuginfo: before 1.31.1-13

busybox-petitboot: before 1.31.1-13

busybox-help: before 1.31.1-13

busybox: before 1.31.1-13

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1449


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use-after-free

EUVDB-ID: #VU58685

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-42384

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the "handle_special" function. A remote administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP2

busybox-debugsource: before 1.31.1-13

busybox-debuginfo: before 1.31.1-13

busybox-petitboot: before 1.31.1-13

busybox-help: before 1.31.1-13

busybox: before 1.31.1-13

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1449


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###