BusyBox: Multiple vulnerabilities

BusyBox: Multiple vulnerabilities Multiple vulnerabilities have been found in BusyBox, the worst of which allows remote attackers to execute arbitrary code. busybox December 04, 2016 December 04, 2016: 1 564246 577610 local, remote 1.24.2 1.24.2

BusyBox is a set of tools for embedded systems and is a replacement for GNU Coreutils.

Multiple vulnerabilities have been discovered in BusyBox. Please review the CVE identifiers referenced below for details.

A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition.

There is no known workaround at this time. However, on Gentoo, the remote code execution vulnerability can be avoided if you don’t use BusyBox’s udhcpc or build the package without the “ipv6” USE flag enabled.

All BusyBox users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=sys-apps/busybox-1.24.2"

CVE-2016-2147 CVE-2016-2148 BlueKnight whissi