CVE-2017-16544 — Code Injection in Busybox
Severity
8.8HIGHNVD
EPSS
3.3%
top 12.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 20
Latest updateMay 13
Description
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages3 packages
Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 14.04, 16.04
Patches
🔴Vulnerability Details
3📋Vendor Advisories
4VMware▶
VMware ESXi and vCenter Server updates address command injection and information disclosure vulnerabilities. (CVE-2017-16544, CVE-2019-5531, CVE-2019-5532, CVE-2019-5534)↗2019-09-16
Debian▶
CVE-2017-16544: busybox - In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab...↗2017