CVE-2016-2147: Integer Overflow
Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/busyboxto a version that resolves this vulnerability.Fixed in 1:1.30.1-6Fixed in 1:1.30.1-6+deb11u1Fixed in 1:1.35.0-4+deb12u1Fixed in 1:1.37.0-6Fixed in 1:1.37.0-10.1 - Upgrade
Upgrade
BusyBox udhcpcto a version that resolves this vulnerability.Fixed in 1.25.0
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2016-2147.
What is the severity of CVE-2016-2147?
The severity of CVE-2016-2147 is high with a severity value of 7.5.
How does CVE-2016-2147 impact the affected software?
CVE-2016-2147 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-encoded domain name, which triggers an out-of-bounds heap write.
Which versions of BusyBox are affected by CVE-2016-2147?
Versions up to and including 1.24.2 of BusyBox are affected by CVE-2016-2147.
How can I fix CVE-2016-2147?
To fix CVE-2016-2147, update BusyBox to version 1.25.0 or higher.