Multiple vulnerabilities in BusyBox

1) Out-of-bounds read

EUVDB-ID: #VU58670

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-42374

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in "unlzma". A remote attacker can trigger out-of-bounds read error and read contents of memory on the system or perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

BusyBox: 1.27.0 - 1.33.1

CPE2.3

cpe:2.3:a:busybox_net:busybox:1.27.0:*:*:*:*:*:*:*

External links

http://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Use-after-free

EUVDB-ID: #VU58694

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-42380

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the "next_input_file" function. A remote administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

BusyBox: 1.18.0 - 1.33.1

CPE2.3

cpe:2.3:a:busybox_net:busybox:1.18.2:*:*:*:*:*:*:*

External links

http://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Use-after-free

EUVDB-ID: #VU58692

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-42379

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the "next_input_file" function. A remote administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

BusyBox: 1.18.0 - 1.33.1

CPE2.3

cpe:2.3:a:busybox_net:busybox:1.18.2:*:*:*:*:*:*:*

External links

http://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) Use-after-free

EUVDB-ID: #VU58685

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-42384

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the "handle_special" function. A remote administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

BusyBox: 1.18.0 - 1.33.1

CPE2.3

cpe:2.3:a:busybox_net:busybox:1.18.2:*:*:*:*:*:*:*

External links

http://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

5) Use-after-free

EUVDB-ID: #VU58684

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-42382

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the "getvar_s" function. A remote administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

BusyBox: 1.26.0 - 1.33.1

CPE2.3

cpe:2.3:a:busybox_net:busybox:1.26.2:*:*:*:*:*:*:*

External links

http://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

6) Use-after-free

EUVDB-ID: #VU58683

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-42385

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the "evaluate" function. A remote administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

BusyBox: 1.16.0 - 1.33.1

CPE2.3

cpe:2.3:a:busybox_net:busybox:1.16.0:*:*:*:*:*:*:*

External links

http://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

7) Use-after-free

EUVDB-ID: #VU58680

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-42378

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the "getvar_i" function. A remote administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

BusyBox: 1.16.0 - 1.33.1

CPE2.3

cpe:2.3:a:busybox_net:busybox:1.16.0:*:*:*:*:*:*:*

External links

http://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

8) Use-after-free

EUVDB-ID: #VU58678

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-42386

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the "nvalloc" function. A remote administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

BusyBox: 1.16.0 - 1.33.1

CPE2.3

cpe:2.3:a:busybox_net:busybox:1.16.0:*:*:*:*:*:*:*

External links

http://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

9) Use-after-free

EUVDB-ID: #VU58673

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-42381

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the "hash_init" function. A remote administrator can execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

BusyBox: 1.21.0 - 1.33.1

CPE2.3

cpe:2.3:a:busybox_net:busybox:1.27.1:*:*:*:*:*:*:*

External links

http://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

10) NULL pointer dereference

EUVDB-ID: #VU59877

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-42376

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in Busybox's hush applet when processing a crafted shell command with a \x03 delimiter character. A local user can pass specially crafted string to the affected applet and crash the application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

BusyBox: 1.16.0 - 1.33.1

CPE2.3

cpe:2.3:a:busybox_net:busybox:1.33.1:*:*:*:*:*:*:*

External links

http://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
http://security.netapp.com/advisory/ntap-20211223-0002/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

11) Use-after-free

EUVDB-ID: #VU69654

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-42383

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the awk applet. A remote privileged user can pass a specially crafted input to the application, trigger a use-after-free error and execute arbitrary code.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

BusyBox: 1.33.1

CPE2.3

cpe:2.3:a:busybox_net:busybox:1.33.1:*:*:*:*:*:*:*

External links

http://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
http://security.netapp.com/advisory/ntap-20211223-0002/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

12) Input validation error

EUVDB-ID: #VU69652

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-42375

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the ash applet. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

BusyBox: 0.38 - 1.33.1

CPE2.3

cpe:2.3:a:busybox_net:busybox:1.33.1:*:*:*:*:*:*:*

External links

http://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
http://security.netapp.com/advisory/ntap-20211223-0002/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

13) NULL pointer dereference

EUVDB-ID: #VU69651

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-42373

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the man applet when a section name is supplied but no page argument is given. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

BusyBox: 1.0.0 - 1.33.1

CPE2.3

cpe:2.3:a:busybox_net:busybox:1.33.1:*:*:*:*:*:*:*

External links

http://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
http://security.netapp.com/advisory/ntap-20211223-0002/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

14) Release of invalid pointer or reference

EUVDB-ID: #VU69653

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2021-42377

CWE-ID: CWE-763 - Release of invalid pointer or reference

Exploit availability: No

Description

The vulnerability allows a remote attacker execute arbitrary code on the system.

The vulnerability exists due to improper input validation within the hush applet. A remote attacker can pass a specially crafted input to the application and potentially execute arbitrary shell commands.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

BusyBox: 1.33.0 - 1.33.1

CPE2.3

cpe:2.3:a:busybox_net:busybox:1.33.1:*:*:*:*:*:*:*

External links

http://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
http://security.netapp.com/advisory/ntap-20211223-0002/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

Risk	Medium
Patch available	YES
Number of vulnerabilities	14
CVE-ID	CVE-2021-42374 CVE-2021-42380 CVE-2021-42379 CVE-2021-42384 CVE-2021-42382 CVE-2021-42385 CVE-2021-42378 CVE-2021-42386 CVE-2021-42381 CVE-2021-42376 CVE-2021-42383 CVE-2021-42375 CVE-2021-42373 CVE-2021-42377
CWE-ID	CWE-125 CWE-416 CWE-476 CWE-20 CWE-763
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	BusyBox Universal components / Libraries / Software for developers
Vendor	busybox.net