Improper input validation in BusyBox - CVE-2017-16544
Published: March 29, 2018 / Updated: August 28, 2020
Vulnerability identifier: #VU11326
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-16544
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists in the add_match function in libbb/lineedit.c due to the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. A remote attacker can execute arbitrary code with the system privileges and write arbitrary files.
Successful exploitation of the vulnerability may result in system compromise.
The weakness exists in the add_match function in libbb/lineedit.c due to the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. A remote attacker can execute arbitrary code with the system privileges and write arbitrary files.
Successful exploitation of the vulnerability may result in system compromise.
Affected software
BusyBox
Arch Linux
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
VMware ESXi
SUSE Enterprise Storage
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
openSUSE Leap
N-Tron 702M12-W
N-Tron 702-W
busybox (Alpine package)
busybox
busybox-static
busybox-testsuite
busybox-warewulf3
Arch Linux
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
VMware ESXi
SUSE Enterprise Storage
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
openSUSE Leap
N-Tron 702M12-W
N-Tron 702-W
busybox (Alpine package)
busybox
busybox-static
busybox-testsuite
busybox-warewulf3
How to mitigate CVE-2017-16544
Update to version 1.28.0.
busybox (Alpine package) - update to 1.24.2-r2
busybox - addressed in versions 1.34.1-4.9.1, 1.35.0-4.3.1, 1.35.0-150400.3.3.1
busybox-static - addressed in versions 1.34.1-4.9.1, 1.35.0-150400.3.3.1
busybox-testsuite - update to 1.35.0-150400.3.3.1
busybox-warewulf3 - update to 1.35.0-150400.3.3.1
busybox - addressed in versions 1.34.1-4.9.1, 1.35.0-4.3.1, 1.35.0-150400.3.3.1
busybox-static - addressed in versions 1.34.1-4.9.1, 1.35.0-150400.3.3.1
busybox-testsuite - update to 1.35.0-150400.3.3.1
busybox-warewulf3 - update to 1.35.0-150400.3.3.1
External References
Related Security Bulletins
- Gentoo update for BusyBox
- Arch Linux update for busybox
- Arch Linux update for mkinitcpio-busybox
- Multiplle vulnerabilities in VMWare ESXi and vCenter
- Improper input validation in busybox (Alpine package)
- Multiple vulnerabilities in Red Lion N-Tron 702-W and 702M12-W
- SUSE update for busybox
- SUSE update for busybox
- SUSE update for busybox
- SUSE update for busybox