A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the hash_init function (CVE-2021-42381)

Note that Nessus relies on the presence of the package as reported by the vendor.

A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4019 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4019-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     January 19, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : busybox     Version        : 1:1.30.1-6+deb11u1     CVE ID         : CVE-2021-28831 CVE-2021-42374 CVE-2021-42378 CVE-2021-42379                      CVE-2021-42380 CVE-2021-42381 CVE-2021-42382 CVE-2021-42384                      CVE-2021-42385 CVE-2021-42386 CVE-2022-48174 CVE-2023-42364                      CVE-2023-42365     Debian Bug     : 985674 999567 1059049 1059051 1059052

    Multiple vulnerabilities have been found in BusyBox, a lightweight     single-executable containing various Unix utilities, which potentially     allow attackers to cause denial of service, information leakage, or     arbitrary code execution through malformed gzip data, crafted LZMA     input or crafted awk patterns.

    CVE-2021-28831

        decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit         on the huft_build result pointer, with a resultant invalid free or         segmentation fault, via malformed gzip data.

    CVE-2021-42374

        An out-of-bounds heap read in Busybox's unlzma applet leads to         information leak and denial of service when crafted LZMA-compressed         input is decompressed. This can be triggered by any applet/format that

    CVE-2021-42378

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         getvar_i function

    CVE-2021-42379

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         next_input_file function

    CVE-2021-42380

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         clrvar function

    CVE-2021-42381

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         hash_init function

    CVE-2021-42382

        use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         getvar_s function

    CVE-2021-42384

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         handle_special function

    CVE-2021-42385

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         evaluate function

    CVE-2021-42386

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         nvalloc function

    CVE-2022-48174

        There is a stack overflow vulnerability in ash.c:6030 in busybox before         1.35. In the environment of Internet of Vehicles, this vulnerability can         be executed from command to arbitrary code execution.

    CVE-2023-42364

        A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to         cause a denial of service via a crafted awk pattern in the awk.c         evaluate function.

    CVE-2023-42365

        A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a         crafted awk pattern in the awk.c copyvar function.

    For Debian 11 bullseye, these problems have been fixed in version     1:1.30.1-6+deb11u1.

    We recommend that you upgrade your busybox packages.

    For the detailed security status of busybox please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/busybox

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202407-17 (BusyBox: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in BusyBox. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of busybox installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-42381 advisory.

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the hash_init function (CVE-2021-42381)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4253-1 advisory.

  - Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote     attackers to point to files outside the current working directory via a symlink. (CVE-2011-5325)

  - The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass     intended restrictions on loading kernel modules via a / (slash) character in a module name, as     demonstrated by an ifconfig /usbserial up command or a mount -t /snd_pcm none / command.
    (CVE-2014-9645)

  - huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing     segfaults and an application crash during an unzip operation on a specially crafted ZIP file.
    (CVE-2015-9261)

  - Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a     denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds     heap write. (CVE-2016-2147)

  - Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to     have unspecified impact via vectors involving OPTION_6RD parsing. (CVE-2016-2148)

  - The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause     a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a     communication loop. (CVE-2016-6301)

  - The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer     Overflow that may lead to a write access violation. (CVE-2017-15873)

  - archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read     access violation. (CVE-2017-15874)

  - In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of     the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in     executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary     file writes, or other attacks. (CVE-2017-16544)

  - Busybox contains a Missing SSL certificate validation vulnerability in The busybox wget applet that can     result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over     HTTPS using busybox wget https://compromised-domain.com/important-file. (CVE-2018-1000500)

  - BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a     Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear     to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit     8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e. (CVE-2018-1000517)

  - An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by     the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack     by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in     networking/udhcp/common.c that 4-byte options are indeed 4 bytes. (CVE-2018-20679)

  - An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by     the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from     the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding     DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679. (CVE-2019-5747)

  - decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer,     with a resultant invalid free or segmentation fault, via malformed gzip data. (CVE-2021-28831)

  - A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is     supplied but no page argument is given (CVE-2021-42373)

  - An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when     crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that     (CVE-2021-42374)

  - An incorrect handling of a special element in Busybox's ash applet leads to denial of service when     processing a crafted shell command, due to the shell mistaking specific characters for reserved     characters. This may be used for DoS under rare conditions of filtered command input. (CVE-2021-42375)

  - A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted     shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under     very rare conditions of filtered command input. (CVE-2021-42376)

  - An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code     execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may     be used for remote code execution under rare conditions of filtered command input. (CVE-2021-42377)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the getvar_i function (CVE-2021-42378)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the next_input_file function (CVE-2021-42379)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the clrvar function (CVE-2021-42380)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the hash_init function (CVE-2021-42381)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the getvar_s function (CVE-2021-42382)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the evaluate function (CVE-2021-42383, CVE-2021-42385)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the handle_special function (CVE-2021-42384)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the nvalloc function (CVE-2021-42386)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3959-1 advisory.

  - Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote     attackers to point to files outside the current working directory via a symlink. (CVE-2011-5325)

  - huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing     segfaults and an application crash during an unzip operation on a specially crafted ZIP file.
    (CVE-2015-9261)

  - Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a     denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds     heap write. (CVE-2016-2147)

  - Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to     have unspecified impact via vectors involving OPTION_6RD parsing. (CVE-2016-2148)

  - The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause     a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a     communication loop. (CVE-2016-6301)

  - The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer     Overflow that may lead to a write access violation. (CVE-2017-15873)

  - archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read     access violation. (CVE-2017-15874)

  - In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of     the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in     executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary     file writes, or other attacks. (CVE-2017-16544)

  - Busybox contains a Missing SSL certificate validation vulnerability in The busybox wget applet that can     result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over     HTTPS using busybox wget https://compromised-domain.com/important-file. (CVE-2018-1000500)

  - BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a     Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear     to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit     8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e. (CVE-2018-1000517)

  - An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by     the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack     by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in     networking/udhcp/common.c that 4-byte options are indeed 4 bytes. (CVE-2018-20679)

  - An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by     the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from     the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding     DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679. (CVE-2019-5747)

  - decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer,     with a resultant invalid free or segmentation fault, via malformed gzip data. (CVE-2021-28831)

  - A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is     supplied but no page argument is given (CVE-2021-42373)

  - An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when     crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that     (CVE-2021-42374)

  - An incorrect handling of a special element in Busybox's ash applet leads to denial of service when     processing a crafted shell command, due to the shell mistaking specific characters for reserved     characters. This may be used for DoS under rare conditions of filtered command input. (CVE-2021-42375)

  - A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted     shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under     very rare conditions of filtered command input. (CVE-2021-42376)

  - An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code     execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may     be used for remote code execution under rare conditions of filtered command input. (CVE-2021-42377)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the getvar_i function (CVE-2021-42378)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the next_input_file function (CVE-2021-42379)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the clrvar function (CVE-2021-42380)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the hash_init function (CVE-2021-42381)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the getvar_s function (CVE-2021-42382)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the evaluate function (CVE-2021-42383, CVE-2021-42385)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the handle_special function (CVE-2021-42384)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the nvalloc function (CVE-2021-42386)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the busybox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted     shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under     very rare conditions of filtered command input. (CVE-2021-42376)

  - An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code     execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may     be used for remote code execution under rare conditions of filtered command input. (CVE-2021-42377)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the getvar_i function (CVE-2021-42378)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the next_input_file function (CVE-2021-42379)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the clrvar function (CVE-2021-42380)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the hash_init function (CVE-2021-42381)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the getvar_s function (CVE-2021-42382)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the evaluate function (CVE-2021-42383, CVE-2021-42385)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the handle_special function (CVE-2021-42384)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the nvalloc function (CVE-2021-42386)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the busybox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when     crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that     (CVE-2021-42374)

  - A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted     shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under     very rare conditions of filtered command input. (CVE-2021-42376)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the getvar_i function (CVE-2021-42378)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the next_input_file function (CVE-2021-42379)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the clrvar function (CVE-2021-42380)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the hash_init function (CVE-2021-42381)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the getvar_s function (CVE-2021-42382)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the evaluate function (CVE-2021-42383, CVE-2021-42385)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the handle_special function (CVE-2021-42384)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the nvalloc function (CVE-2021-42386)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0135-2 advisory.

  - Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote     attackers to point to files outside the current working directory via a symlink. (CVE-2011-5325)

  - huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing     segfaults and an application crash during an unzip operation on a specially crafted ZIP file.
    (CVE-2015-9261)

  - Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a     denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds     heap write. (CVE-2016-2147)

  - Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to     have unspecified impact via vectors involving OPTION_6RD parsing. (CVE-2016-2148)

  - The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause     a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a     communication loop. (CVE-2016-6301)

  - The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer     Overflow that may lead to a write access violation. (CVE-2017-15873)

  - archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read     access violation. (CVE-2017-15874)

  - In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of     the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in     executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary     file writes, or other attacks. (CVE-2017-16544)

  - Busybox contains a Missing SSL certificate validation vulnerability in The busybox wget applet that can     result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over     HTTPS using busybox wget https://compromised-domain.com/important-file. (CVE-2018-1000500)

  - BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a     Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear     to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit     8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e. (CVE-2018-1000517)

  - An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by     the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack     by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in     networking/udhcp/common.c that 4-byte options are indeed 4 bytes. (CVE-2018-20679)

  - An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by     the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from     the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding     DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679. (CVE-2019-5747)

  - decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer,     with a resultant invalid free or segmentation fault, via malformed gzip data. (CVE-2021-28831)

  - A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is     supplied but no page argument is given (CVE-2021-42373)

  - An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when     crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that     (CVE-2021-42374)

  - An incorrect handling of a special element in Busybox's ash applet leads to denial of service when     processing a crafted shell command, due to the shell mistaking specific characters for reserved     characters. This may be used for DoS under rare conditions of filtered command input. (CVE-2021-42375)

  - A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted     shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under     very rare conditions of filtered command input. (CVE-2021-42376)

  - An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code     execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may     be used for remote code execution under rare conditions of filtered command input. (CVE-2021-42377)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the getvar_i function (CVE-2021-42378)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the next_input_file function (CVE-2021-42379)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the clrvar function (CVE-2021-42380)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the hash_init function (CVE-2021-42381)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the getvar_s function (CVE-2021-42382)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the evaluate function (CVE-2021-42383, CVE-2021-42385)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the handle_special function (CVE-2021-42384)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the nvalloc function (CVE-2021-42386)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0135-1 advisory.

  - Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote     attackers to point to files outside the current working directory via a symlink. (CVE-2011-5325)

  - huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing     segfaults and an application crash during an unzip operation on a specially crafted ZIP file.
    (CVE-2015-9261)

  - Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a     denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds     heap write. (CVE-2016-2147)

  - Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to     have unspecified impact via vectors involving OPTION_6RD parsing. (CVE-2016-2148)

  - The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause     a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a     communication loop. (CVE-2016-6301)

  - The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer     Overflow that may lead to a write access violation. (CVE-2017-15873)

  - archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read     access violation. (CVE-2017-15874)

  - In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of     the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in     executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary     file writes, or other attacks. (CVE-2017-16544)

  - Busybox contains a Missing SSL certificate validation vulnerability in The busybox wget applet that can     result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over     HTTPS using busybox wget https://compromised-domain.com/important-file. (CVE-2018-1000500)

  - BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a     Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear     to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit     8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e. (CVE-2018-1000517)

  - An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by     the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack     by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in     networking/udhcp/common.c that 4-byte options are indeed 4 bytes. (CVE-2018-20679)

  - An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by     the DHCP server, client, and/or relay) might allow a remote attacker to leak sensitive information from     the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding     DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679. (CVE-2019-5747)

  - decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer,     with a resultant invalid free or segmentation fault, via malformed gzip data. (CVE-2021-28831)

  - A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is     supplied but no page argument is given (CVE-2021-42373)

  - An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when     crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that     (CVE-2021-42374)

  - An incorrect handling of a special element in Busybox's ash applet leads to denial of service when     processing a crafted shell command, due to the shell mistaking specific characters for reserved     characters. This may be used for DoS under rare conditions of filtered command input. (CVE-2021-42375)

  - A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted     shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under     very rare conditions of filtered command input. (CVE-2021-42376)

  - An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code     execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may     be used for remote code execution under rare conditions of filtered command input. (CVE-2021-42377)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the getvar_i function (CVE-2021-42378)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the next_input_file function (CVE-2021-42379)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the clrvar function (CVE-2021-42380)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the hash_init function (CVE-2021-42381)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the getvar_s function (CVE-2021-42382)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the evaluate function (CVE-2021-42383, CVE-2021-42385)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the handle_special function (CVE-2021-42384)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the nvalloc function (CVE-2021-42386)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0135-1 advisory.

  - Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote     attackers to point to files outside the current working directory via a symlink. (CVE-2011-5325)

  - huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing     segfaults and an application crash during an unzip operation on a specially crafted ZIP file.
    (CVE-2015-9261)

  - Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a     denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds     heap write. (CVE-2016-2147)

  - Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to     have unspecified impact via vectors involving OPTION_6RD parsing. (CVE-2016-2148)

  - The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause     a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a     communication loop. (CVE-2016-6301)

  - The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer     Overflow that may lead to a write access violation. (CVE-2017-15873)

  - archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read     access violation. (CVE-2017-15874)

  - In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of     the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in     executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary     file writes, or other attacks. (CVE-2017-16544)

  - Busybox contains a Missing SSL certificate validation vulnerability in The busybox wget applet that can     result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over     HTTPS using busybox wget https://compromised-domain.com/important-file. (CVE-2018-1000500)

  - BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a     Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear     to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit     8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e. (CVE-2018-1000517)

  - An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by     the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack     by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in     networking/udhcp/common.c that 4-byte options are indeed 4 bytes. (CVE-2018-20679)

  - An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by     the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from     the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding     DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679. (CVE-2019-5747)

  - decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer,     with a resultant invalid free or segmentation fault, via malformed gzip data. (CVE-2021-28831)

  - A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is     supplied but no page argument is given (CVE-2021-42373)

  - An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when     crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that     (CVE-2021-42374)

  - An incorrect handling of a special element in Busybox's ash applet leads to denial of service when     processing a crafted shell command, due to the shell mistaking specific characters for reserved     characters. This may be used for DoS under rare conditions of filtered command input. (CVE-2021-42375)

  - A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted     shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under     very rare conditions of filtered command input. (CVE-2021-42376)

  - An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code     execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may     be used for remote code execution under rare conditions of filtered command input. (CVE-2021-42377)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the getvar_i function (CVE-2021-42378)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the next_input_file function (CVE-2021-42379)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the clrvar function (CVE-2021-42380)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the hash_init function (CVE-2021-42381)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the getvar_s function (CVE-2021-42382)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the evaluate function (CVE-2021-42383, CVE-2021-42385)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the handle_special function (CVE-2021-42384)

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the nvalloc function (CVE-2021-42386)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5179-1 advisory.

    It was discovered that BusyBox incorrectly handled certain malformed gzip archives. If a user or automated     system were tricked into processing a specially crafted gzip archive, a remote attacker could use this     issue to cause BusyBox to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2021-28831)

    It was discovered that BusyBox incorrectly handled certain malformed LZMA archives. If a user or automated     system were tricked into processing a specially crafted LZMA archive, a remote attacker could use this     issue to cause BusyBox to crash, resulting in a denial of service, or possibly leak sensitive information.
    (CVE-2021-42374)

    Vera Mens, Uri Katz, Tal Keren, Sharon Brizinov, and Shachar Menashe discovered that BusyBox incorrectly     handled certain awk patterns. If a user or automated system were tricked into processing a specially     crafted awk pattern, a remote attacker could use this issue to cause BusyBox to crash, resulting in a     denial of service, or possibly execute arbitrary code. (CVE-2021-42378, CVE-2021-42379, CVE-2021-42380,     CVE-2021-42381, CVE-2021-42382, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
255911	Linux Distros Unpatched Vulnerability : CVE-2021-42381	Nessus	Misc.	high
502996	Siemens SIMATIC S7-1500 TM MFP BIOS Use After Free (CVE-2021-42381)	Tenable OT Security	Tenable.ot	high
214387	Debian dla-4019 : busybox - security update	Nessus	Debian Local Security Checks	critical
201913	GLSA-202407-17 : BusyBox: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
172928	CBL Mariner 2.0 Security Update: busybox (CVE-2021-42381)	Nessus	MarinerOS Local Security Checks	high
168240	SUSE SLES12 Security Update : busybox (SUSE-SU-2022:4253-1)	Nessus	SuSE Local Security Checks	critical
167330	SUSE SLED15 / SLES15 Security Update : busybox (SUSE-SU-2022:3959-1)	Nessus	SuSE Local Security Checks	critical
159984	EulerOS 2.0 SP10 : busybox (EulerOS-SA-2022-1472)	Nessus	Huawei Local Security Checks	critical
159942	EulerOS 2.0 SP10 : busybox (EulerOS-SA-2022-1463)	Nessus	Huawei Local Security Checks	critical
158547	EulerOS 2.0 SP9 : busybox (EulerOS-SA-2022-1303)	Nessus	Huawei Local Security Checks	high
158526	EulerOS 2.0 SP9 : busybox (EulerOS-SA-2022-1287)	Nessus	Huawei Local Security Checks	high
158060	SUSE SLES15 Security Update : busybox (SUSE-SU-2022:0135-2)	Nessus	SuSE Local Security Checks	critical
156938	openSUSE 15 Security Update : busybox (openSUSE-SU-2022:0135-1)	Nessus	SuSE Local Security Checks	critical
156924	SUSE SLED15 / SLES15 Security Update : busybox (SUSE-SU-2022:0135-1)	Nessus	SuSE Local Security Checks	critical
155939	Ubuntu 18.04 LTS / 20.04 LTS : BusyBox vulnerabilities (USN-5179-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2021-42381

high

Tenable Plugins

high

high

critical

critical

high

critical

critical

critical

critical

high

high

critical

critical

critical

critical