CVE-2016-2148: Buffer Overflow
Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION6RD parsing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.8.4 - Upgrade
Upgrade
debian/busyboxto a version that resolves this vulnerability.Fixed in 1:1.30.1-6Fixed in 1:1.30.1-6+deb11u1Fixed in 1:1.35.0-4+deb12u1Fixed in 1:1.37.0-6Fixed in 1:1.37.0-10.1 - Upgrade
Upgrade
BusyBoxto a version that resolves this vulnerability.Fixed in 1.25.0
Event History
Frequently Asked Questions
What is the vulnerability ID for this heap-based buffer overflow vulnerability?
The vulnerability ID for this heap-based buffer overflow vulnerability is CVE-2016-2148.
What is the severity rating of CVE-2016-2148?
CVE-2016-2148 has a severity rating of 9.8 (critical).
Which software versions are affected by CVE-2016-2148?
BusyBox versions before 1.25.0 are affected by CVE-2016-2148.
How can remote attackers exploit this vulnerability?
Remote attackers can exploit this vulnerability through vectors involving OPTION_6RD parsing.
Are there any remediation steps available for this vulnerability?
Yes, the affected software versions can be remediated by updating to the specified fixed versions.