CVE-2017-16544Code Injection in Busybox

Severity
8.8HIGHNVD
EPSS
3.3%
top 12.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedNov 20
Latest updateMay 13

Description

In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

Debianbusybox/busybox< 1:1.27.2-2+3
NVDbusybox/busybox1.27.2
NVDvmware/esxi6.0, 6.5, 6.7+2

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 14.04, 16.04

Patches

🔴Vulnerability Details

3
GHSA
GHSA-234c-568r-p7m4: In the add_match function in libbb/lineedit2022-05-13
OSV
CVE-2017-16544: In the add_match function in libbb/lineedit2017-11-20
CVEList
CVE-2017-16544: In the add_match function in libbb/lineedit2017-11-20

📋Vendor Advisories

4
VMware
VMware ESXi and vCenter Server updates address command injection and information disclosure vulnerabilities. (CVE-2017-16544, CVE-2019-5531, CVE-2019-5532, CVE-2019-5534)2019-09-16
Ubuntu
BusyBox vulnerabilities2019-04-03
Red Hat
busybox: Insufficient sanitization of filenames when autocompleting2017-11-08
Debian
CVE-2017-16544: busybox - In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab...2017

💬Community

2
Bugzilla
CVE-2017-16544 busybox: Insufficient sanitization of filenames when autocompleting2017-11-21
Bugzilla
CVE-2017-15873 CVE-2017-15874 CVE-2017-16544 busybox: various flaws [fedora-all]2017-11-20
CVE-2017-16544 — Code Injection in Busybox | cvebase