Resource management error in BusyBox - CVE-2016-6301

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU31448

Resource management error in BusyBox - CVE-2016-6301

Published: December 9, 2016 / Updated: July 23, 2020


Vulnerability identifier: #VU31448
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-6301
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.


Affected software

BusyBox
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE Enterprise Storage
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
openSUSE Leap
busybox (Alpine package)
busybox
busybox-static
busybox-testsuite
busybox-warewulf3

How to mitigate CVE-2016-6301

Install update from vendor's website.

BusyBox - update to 1.25.1
busybox (Alpine package) - update to 1.23.2-r1
busybox - addressed in versions 1.34.1-4.9.1, 1.35.0-4.3.1, 1.35.0-150400.3.3.1
busybox-static - addressed in versions 1.34.1-4.9.1, 1.35.0-150400.3.3.1
busybox-testsuite - update to 1.35.0-150400.3.3.1
busybox-warewulf3 - update to 1.35.0-150400.3.3.1

External References

Related Security Bulletins