glsa-201612-04.xml


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="201612-04">
  <title>BusyBox: Multiple vulnerabilities</title>
  <synopsis>Multiple vulnerabilities have been found in BusyBox, the worst of
    which allows remote attackers to execute arbitrary code.
  </synopsis>
  <product type="ebuild">busybox</product>
  <announced>2016-12-04</announced>
  <revised count="1">2016-12-04</revised>
  <bug>564246</bug>
  <bug>577610</bug>
  <access>local, remote</access>
  <affected>
    <package name="sys-apps/busybox" auto="yes" arch="*">
      <unaffected range="ge">1.24.2</unaffected>
      <vulnerable range="lt">1.24.2</vulnerable>
    </package>
  </affected>
  <background>
    <p>BusyBox is a set of tools for embedded systems and is a replacement for
      GNU Coreutils.
    </p>
  </background>
  <description>
    <p>Multiple vulnerabilities have been discovered in BusyBox. Please review
      the CVE identifiers referenced below for details.
    </p>
  </description>
  <impact type="normal">
    <p>A remote attacker could possibly execute arbitrary code with the
      privileges of the process, or cause a Denial of Service condition.
    </p>
  </impact>
  <workaround>
    <p>There is no known workaround at this time. However, on Gentoo, the
      remote code execution vulnerability can be avoided if you don’t use
      BusyBox’s udhcpc or build the package without the “ipv6” USE flag
      enabled.
    </p>
  </workaround>
  <resolution>
    <p>All BusyBox users should upgrade to the latest version:</p>
    
    <code>
      # emerge --sync
      # emerge --ask --oneshot --verbose "&gt;=sys-apps/busybox-1.24.2"
    </code>
    
  </resolution>
  <references>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2147">CVE-2016-2147</uri>
    <uri link="https://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2148">CVE-2016-2148</uri>
  </references>
  <metadata tag="requester" timestamp="2015-12-31T06:28:35Z">
    BlueKnight
  </metadata>
  <metadata tag="submitter" timestamp="2016-12-04T06:39:16Z">whissi</metadata>
</glsa>