CVE-2017-16544: Code Injection
First published: Mon Nov 20 2017(Updated: )
In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Busybox Busybox | <=1.27.2 | |
| Debian Debian Linux | =8.0 | |
| Debian Debian Linux | =9.0 | |
| VMware ESXi | =6.0 | |
| VMware ESXi | =6.0 | |
| VMware ESXi | =6.0-1 | |
| VMware ESXi | =6.0-1a | |
| VMware ESXi | =6.0-1b | |
| VMware ESXi | =6.0-2 | |
| VMware ESXi | =6.0-3 | |
| VMware ESXi | =6.0-3a | |
| VMware ESXi | =6.0-600-201504401 | |
| VMware ESXi | =6.0-600-201505401 | |
| VMware ESXi | =6.0-600-201507101 | |
| VMware ESXi | =6.0-600-201507102 | |
| VMware ESXi | =6.0-600-201507401 | |
| VMware ESXi | =6.0-600-201507402 | |
| VMware ESXi | =6.0-600-201507403 | |
| VMware ESXi | =6.0-600-201507404 | |
| VMware ESXi | =6.0-600-201507405 | |
| VMware ESXi | =6.0-600-201507406 | |
| VMware ESXi | =6.0-600-201507407 | |
| VMware ESXi | =6.0-600-201509101 | |
| VMware ESXi | =6.0-600-201509102 | |
| VMware ESXi | =6.0-600-201509201 | |
| VMware ESXi | =6.0-600-201509202 | |
| VMware ESXi | =6.0-600-201509203 | |
| VMware ESXi | =6.0-600-201509204 | |
| VMware ESXi | =6.0-600-201509205 | |
| VMware ESXi | =6.0-600-201509206 | |
| VMware ESXi | =6.0-600-201509207 | |
| VMware ESXi | =6.0-600-201509208 | |
| VMware ESXi | =6.0-600-201509209 | |
| VMware ESXi | =6.0-600-201509210 | |
| VMware ESXi | =6.0-600-201510401 | |
| VMware ESXi | =6.0-600-201511401 | |
| VMware ESXi | =6.0-600-201601101 | |
| VMware ESXi | =6.0-600-201601102 | |
| VMware ESXi | =6.0-600-201601401 | |
| VMware ESXi | =6.0-600-201601402 | |
| VMware ESXi | =6.0-600-201601403 | |
| VMware ESXi | =6.0-600-201601404 | |
| VMware ESXi | =6.0-600-201601405 | |
| VMware ESXi | =6.0-600-201602401 | |
| VMware ESXi | =6.0-600-201603101 | |
| VMware ESXi | =6.0-600-201603102 | |
| VMware ESXi | =6.0-600-201603201 | |
| VMware ESXi | =6.0-600-201603202 | |
| VMware ESXi | =6.0-600-201603203 | |
| VMware ESXi | =6.0-600-201603204 | |
| VMware ESXi | =6.0-600-201603205 | |
| VMware ESXi | =6.0-600-201603206 | |
| VMware ESXi | =6.0-600-201603207 | |
| VMware ESXi | =6.0-600-201603208 | |
| VMware ESXi | =6.0-600-201605401 | |
| VMware ESXi | =6.0-600-201608101 | |
| VMware ESXi | =6.0-600-201608401 | |
| VMware ESXi | =6.0-600-201608402 | |
| VMware ESXi | =6.0-600-201608403 | |
| VMware ESXi | =6.0-600-201608404 | |
| VMware ESXi | =6.0-600-201608405 | |
| VMware ESXi | =6.0-600-201610410 | |
| VMware ESXi | =6.0-600-201611401 | |
| VMware ESXi | =6.0-600-201611402 | |
| VMware ESXi | =6.0-600-201611403 | |
| VMware ESXi | =6.0-600-201702101 | |
| VMware ESXi | =6.0-600-201702102 | |
| VMware ESXi | =6.0-600-201702201 | |
| VMware ESXi | =6.0-600-201702202 | |
| VMware ESXi | =6.0-600-201702203 | |
| VMware ESXi | =6.0-600-201702204 | |
| VMware ESXi | =6.0-600-201702205 | |
| VMware ESXi | =6.0-600-201702206 | |
| VMware ESXi | =6.0-600-201702207 | |
| VMware ESXi | =6.0-600-201702208 | |
| VMware ESXi | =6.0-600-201702209 | |
| VMware ESXi | =6.0-600-201702210 | |
| VMware ESXi | =6.0-600-201702211 | |
| VMware ESXi | =6.0-600-201702212 | |
| VMware ESXi | =6.0-600-201703401 | |
| VMware ESXi | =6.0-600-201706101 | |
| VMware ESXi | =6.0-600-201706102 | |
| VMware ESXi | =6.0-600-201706103 | |
| VMware ESXi | =6.0-600-201706401 | |
| VMware ESXi | =6.0-600-201706402 | |
| VMware ESXi | =6.0-600-201706403 | |
| VMware ESXi | =6.0-600-201710301 | |
| VMware ESXi | =6.0-600-201811001 | |
| VMware ESXi | =6.0-600-201811401 | |
| VMware ESXi | =6.0-600-201903001 | |
| VMware ESXi | =6.0-600-201905001 | |
| VMware ESXi | =6.0-600-201909001 | |
| VMware ESXi | =6.5 | |
| VMware ESXi | =6.5-650-201701001 | |
| VMware ESXi | =6.5-650-201703001 | |
| VMware ESXi | =6.5-650-201703002 | |
| VMware ESXi | =6.5-650-201704001 | |
| VMware ESXi | =6.5-650-201707101 | |
| VMware ESXi | =6.5-650-201707102 | |
| VMware ESXi | =6.5-650-201707103 | |
| VMware ESXi | =6.5-650-201707201 | |
| VMware ESXi | =6.5-650-201707202 | |
| VMware ESXi | =6.5-650-201707203 | |
| VMware ESXi | =6.5-650-201707204 | |
| VMware ESXi | =6.5-650-201707205 | |
| VMware ESXi | =6.5-650-201707206 | |
| VMware ESXi | =6.5-650-201707207 | |
| VMware ESXi | =6.5-650-201707208 | |
| VMware ESXi | =6.5-650-201707209 | |
| VMware ESXi | =6.5-650-201707210 | |
| VMware ESXi | =6.5-650-201707211 | |
| VMware ESXi | =6.5-650-201707212 | |
| VMware ESXi | =6.5-650-201707213 | |
| VMware ESXi | =6.5-650-201707214 | |
| VMware ESXi | =6.5-650-201707215 | |
| VMware ESXi | =6.5-650-201707216 | |
| VMware ESXi | =6.5-650-201707217 | |
| VMware ESXi | =6.5-650-201707218 | |
| VMware ESXi | =6.5-650-201707219 | |
| VMware ESXi | =6.5-650-201707220 | |
| VMware ESXi | =6.5-650-201707221 | |
| VMware ESXi | =6.5-650-201710001 | |
| VMware ESXi | =6.5-650-201712001 | |
| VMware ESXi | =6.5-650-201803001 | |
| VMware ESXi | =6.5-650-201806001 | |
| VMware ESXi | =6.5-650-201808001 | |
| VMware ESXi | =6.5-650-201810001 | |
| VMware ESXi | =6.5-650-201810002 | |
| VMware ESXi | =6.5-650-201811001 | |
| VMware ESXi | =6.5-650-201811002 | |
| VMware ESXi | =6.5-650-201811301 | |
| VMware ESXi | =6.5-650-201901001 | |
| VMware ESXi | =6.5-650-201903001 | |
| VMware ESXi | =6.5-650-201905001 | |
| VMware ESXi | =6.7 | |
| VMware ESXi | =6.7-670-201806001 | |
| VMware ESXi | =6.7-670-201807001 | |
| VMware ESXi | =6.7-670-201808001 | |
| VMware ESXi | =6.7-670-201810001 | |
| VMware ESXi | =6.7-670-201810101 | |
| VMware ESXi | =6.7-670-201810102 | |
| VMware ESXi | =6.7-670-201810103 | |
| VMware ESXi | =6.7-670-201810201 | |
| VMware ESXi | =6.7-670-201810202 | |
| VMware ESXi | =6.7-670-201810203 | |
| VMware ESXi | =6.7-670-201810204 | |
| VMware ESXi | =6.7-670-201810205 | |
| VMware ESXi | =6.7-670-201810206 | |
| VMware ESXi | =6.7-670-201810207 | |
| VMware ESXi | =6.7-670-201810208 | |
| VMware ESXi | =6.7-670-201810209 | |
| VMware ESXi | =6.7-670-201810210 | |
| VMware ESXi | =6.7-670-201810211 | |
| VMware ESXi | =6.7-670-201810212 | |
| VMware ESXi | =6.7-670-201810213 | |
| VMware ESXi | =6.7-670-201810214 | |
| VMware ESXi | =6.7-670-201810215 | |
| VMware ESXi | =6.7-670-201810216 | |
| VMware ESXi | =6.7-670-201810217 | |
| VMware ESXi | =6.7-670-201810218 | |
| VMware ESXi | =6.7-670-201810219 | |
| VMware ESXi | =6.7-670-201810220 | |
| VMware ESXi | =6.7-670-201810221 | |
| VMware ESXi | =6.7-670-201810222 | |
| VMware ESXi | =6.7-670-201810223 | |
| VMware ESXi | =6.7-670-201810224 | |
| VMware ESXi | =6.7-670-201810225 | |
| VMware ESXi | =6.7-670-201810226 | |
| VMware ESXi | =6.7-670-201810227 | |
| VMware ESXi | =6.7-670-201810228 | |
| VMware ESXi | =6.7-670-201810229 | |
| VMware ESXi | =6.7-670-201810230 | |
| VMware ESXi | =6.7-670-201810231 | |
| VMware ESXi | =6.7-670-201810232 | |
| VMware ESXi | =6.7-670-201810233 | |
| VMware ESXi | =6.7-670-201810234 | |
| VMware ESXi | =6.7-670-201811001 | |
| VMware ESXi | =6.7-670-201901001 | |
| VMware ESXi | =6.7-670-201901401 | |
| VMware ESXi | =6.7-670-201901402 | |
| VMware ESXi | =6.7-670-201901403 | |
| VMware ESXi | =6.7-670-201903001 | |
| VMware ESXi | =6.7-670-201904001 | |
| Redlion N-tron 702-w Firmware | ||
| Redlion N-tron 702-w | ||
| Redlion N-tron 702m12-w Firmware | ||
| Redlion N-tron 702m12-w | ||
| Canonical Ubuntu Linux | =14.04 | |
| Canonical Ubuntu Linux | =16.04 | |
| All of | ||
| Redlion N-tron 702-w Firmware | ||
| Redlion N-tron 702-w | ||
| All of | ||
| Redlion N-tron 702m12-w Firmware | ||
| Redlion N-tron 702m12-w | ||
| Red Lion N-Tron 702-W | ||
| Red Lion N-Tron 702M12-W | ||
| debian/busybox | 1:1.30.1-6 1:1.35.0-4 1:1.37.0-4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html
- http://packetstormsecurity.com/files/154536/VMware-Security-Advisory-2019-0013.html
- http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html
- http://seclists.org/fulldisclosure/2019/Jun/18
- http://seclists.org/fulldisclosure/2019/Sep/7
- http://seclists.org/fulldisclosure/2020/Aug/20
- http://seclists.org/fulldisclosure/2020/Mar/15
- http://seclists.org/fulldisclosure/2020/Sep/6
- http://seclists.org/fulldisclosure/2021/Aug/21
- http://seclists.org/fulldisclosure/2021/Jan/39
- http://seclists.org/fulldisclosure/2022/Jun/36
- http://www.vmware.com/security/advisories/VMSA-2019-0013.html
- https://git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e7d9c11e8
- https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html
- https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html
- https://seclists.org/bugtraq/2019/Jun/14
- https://seclists.org/bugtraq/2019/Sep/7
- https://us-cert.cisa.gov/ics/advisories/icsa-20-240-01
- https://usn.ubuntu.com/3935-1/
- https://www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-vulnerability/
- https://launchpad.net/bugs/cve/CVE-2017-16544
- https://www.cisa.gov/news-events/ics-advisories/icsa-20-240-01 (Advisory)
- https://security-tracker.debian.org/tracker/CVE-2017-16544
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16544
- https://nvd.nist.gov/vuln/detail/CVE-2017-16544
- https://ubuntu.com/security/CVE-2017-16544
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/remedy
- agent/description
- agent/severity
- agent/references
- agent/weakness
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup-request
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- collector/usn-cve
- source/Ubuntu
- vendor/busybox
- canonical/busybox busybox
- version/busybox busybox/1.27.2
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- version/debian debian linux/9.0
- vendor/vmware
- canonical/vmware esxi
- version/vmware esxi/6.0
- version/vmware esxi/6.0-1
- version/vmware esxi/6.0-1a
- version/vmware esxi/6.0-1b
- version/vmware esxi/6.0-2
- version/vmware esxi/6.0-3
- version/vmware esxi/6.0-3a
- version/vmware esxi/6.0-600-201504401
- version/vmware esxi/6.0-600-201505401
- version/vmware esxi/6.0-600-201507101
- version/vmware esxi/6.0-600-201507102
- version/vmware esxi/6.0-600-201507401
- version/vmware esxi/6.0-600-201507402
- version/vmware esxi/6.0-600-201507403
- version/vmware esxi/6.0-600-201507404
- version/vmware esxi/6.0-600-201507405
- version/vmware esxi/6.0-600-201507406
- version/vmware esxi/6.0-600-201507407
- version/vmware esxi/6.0-600-201509101
- version/vmware esxi/6.0-600-201509102
- version/vmware esxi/6.0-600-201509201
- version/vmware esxi/6.0-600-201509202
- version/vmware esxi/6.0-600-201509203
- version/vmware esxi/6.0-600-201509204
- version/vmware esxi/6.0-600-201509205
- version/vmware esxi/6.0-600-201509206
- version/vmware esxi/6.0-600-201509207
- version/vmware esxi/6.0-600-201509208
- version/vmware esxi/6.0-600-201509209
- version/vmware esxi/6.0-600-201509210
- version/vmware esxi/6.0-600-201510401
- version/vmware esxi/6.0-600-201511401
- version/vmware esxi/6.0-600-201601101
- version/vmware esxi/6.0-600-201601102
- version/vmware esxi/6.0-600-201601401
- version/vmware esxi/6.0-600-201601402
- version/vmware esxi/6.0-600-201601403
- version/vmware esxi/6.0-600-201601404
- version/vmware esxi/6.0-600-201601405
- version/vmware esxi/6.0-600-201602401
- version/vmware esxi/6.0-600-201603101
- version/vmware esxi/6.0-600-201603102
- version/vmware esxi/6.0-600-201603201
- version/vmware esxi/6.0-600-201603202
- version/vmware esxi/6.0-600-201603203
- version/vmware esxi/6.0-600-201603204
- version/vmware esxi/6.0-600-201603205
- version/vmware esxi/6.0-600-201603206
- version/vmware esxi/6.0-600-201603207
- version/vmware esxi/6.0-600-201603208
- version/vmware esxi/6.0-600-201605401
- version/vmware esxi/6.0-600-201608101
- version/vmware esxi/6.0-600-201608401
- version/vmware esxi/6.0-600-201608402
- version/vmware esxi/6.0-600-201608403
- version/vmware esxi/6.0-600-201608404
- version/vmware esxi/6.0-600-201608405
- version/vmware esxi/6.0-600-201610410
- version/vmware esxi/6.0-600-201611401
- version/vmware esxi/6.0-600-201611402
- version/vmware esxi/6.0-600-201611403
- version/vmware esxi/6.0-600-201702101
- version/vmware esxi/6.0-600-201702102
- version/vmware esxi/6.0-600-201702201
- version/vmware esxi/6.0-600-201702202
- version/vmware esxi/6.0-600-201702203
- version/vmware esxi/6.0-600-201702204
- version/vmware esxi/6.0-600-201702205
- version/vmware esxi/6.0-600-201702206
- version/vmware esxi/6.0-600-201702207
- version/vmware esxi/6.0-600-201702208
- version/vmware esxi/6.0-600-201702209
- version/vmware esxi/6.0-600-201702210
- version/vmware esxi/6.0-600-201702211
- version/vmware esxi/6.0-600-201702212
- version/vmware esxi/6.0-600-201703401
- version/vmware esxi/6.0-600-201706101
- version/vmware esxi/6.0-600-201706102
- version/vmware esxi/6.0-600-201706103
- version/vmware esxi/6.0-600-201706401
- version/vmware esxi/6.0-600-201706402
- version/vmware esxi/6.0-600-201706403
- version/vmware esxi/6.0-600-201710301
- version/vmware esxi/6.0-600-201811001
- version/vmware esxi/6.0-600-201811401
- version/vmware esxi/6.0-600-201903001
- version/vmware esxi/6.0-600-201905001
- version/vmware esxi/6.0-600-201909001
- version/vmware esxi/6.5
- version/vmware esxi/6.5-650-201701001
- version/vmware esxi/6.5-650-201703001
- version/vmware esxi/6.5-650-201703002
- version/vmware esxi/6.5-650-201704001
- version/vmware esxi/6.5-650-201707101
- version/vmware esxi/6.5-650-201707102
- version/vmware esxi/6.5-650-201707103
- version/vmware esxi/6.5-650-201707201
- version/vmware esxi/6.5-650-201707202
- version/vmware esxi/6.5-650-201707203
- version/vmware esxi/6.5-650-201707204
- version/vmware esxi/6.5-650-201707205
- version/vmware esxi/6.5-650-201707206
- version/vmware esxi/6.5-650-201707207
- version/vmware esxi/6.5-650-201707208
- version/vmware esxi/6.5-650-201707209
- version/vmware esxi/6.5-650-201707210
- version/vmware esxi/6.5-650-201707211
- version/vmware esxi/6.5-650-201707212
- version/vmware esxi/6.5-650-201707213
- version/vmware esxi/6.5-650-201707214
- version/vmware esxi/6.5-650-201707215
- version/vmware esxi/6.5-650-201707216
- version/vmware esxi/6.5-650-201707217
- version/vmware esxi/6.5-650-201707218
- version/vmware esxi/6.5-650-201707219
- version/vmware esxi/6.5-650-201707220
- version/vmware esxi/6.5-650-201707221
- version/vmware esxi/6.5-650-201710001
- version/vmware esxi/6.5-650-201712001
- version/vmware esxi/6.5-650-201803001
- version/vmware esxi/6.5-650-201806001
- version/vmware esxi/6.5-650-201808001
- version/vmware esxi/6.5-650-201810001
- version/vmware esxi/6.5-650-201810002
- version/vmware esxi/6.5-650-201811001
- version/vmware esxi/6.5-650-201811002
- version/vmware esxi/6.5-650-201811301
- version/vmware esxi/6.5-650-201901001
- version/vmware esxi/6.5-650-201903001
- version/vmware esxi/6.5-650-201905001
- version/vmware esxi/6.7
- version/vmware esxi/6.7-670-201806001
- version/vmware esxi/6.7-670-201807001
- version/vmware esxi/6.7-670-201808001
- version/vmware esxi/6.7-670-201810001
- version/vmware esxi/6.7-670-201810101
- version/vmware esxi/6.7-670-201810102
- version/vmware esxi/6.7-670-201810103
- version/vmware esxi/6.7-670-201810201
- version/vmware esxi/6.7-670-201810202
- version/vmware esxi/6.7-670-201810203
- version/vmware esxi/6.7-670-201810204
- version/vmware esxi/6.7-670-201810205
- version/vmware esxi/6.7-670-201810206
- version/vmware esxi/6.7-670-201810207
- version/vmware esxi/6.7-670-201810208
- version/vmware esxi/6.7-670-201810209
- version/vmware esxi/6.7-670-201810210
- version/vmware esxi/6.7-670-201810211
- version/vmware esxi/6.7-670-201810212
- version/vmware esxi/6.7-670-201810213
- version/vmware esxi/6.7-670-201810214
- version/vmware esxi/6.7-670-201810215
- version/vmware esxi/6.7-670-201810216
- version/vmware esxi/6.7-670-201810217
- version/vmware esxi/6.7-670-201810218
- version/vmware esxi/6.7-670-201810219
- version/vmware esxi/6.7-670-201810220
- version/vmware esxi/6.7-670-201810221
- version/vmware esxi/6.7-670-201810222
- version/vmware esxi/6.7-670-201810223
- version/vmware esxi/6.7-670-201810224
- version/vmware esxi/6.7-670-201810225
- version/vmware esxi/6.7-670-201810226
- version/vmware esxi/6.7-670-201810227
- version/vmware esxi/6.7-670-201810228
- version/vmware esxi/6.7-670-201810229
- version/vmware esxi/6.7-670-201810230
- version/vmware esxi/6.7-670-201810231
- version/vmware esxi/6.7-670-201810232
- version/vmware esxi/6.7-670-201810233
- version/vmware esxi/6.7-670-201810234
- version/vmware esxi/6.7-670-201811001
- version/vmware esxi/6.7-670-201901001
- version/vmware esxi/6.7-670-201901401
- version/vmware esxi/6.7-670-201901402
- version/vmware esxi/6.7-670-201901403
- version/vmware esxi/6.7-670-201903001
- version/vmware esxi/6.7-670-201904001
- vendor/redlion
- canonical/redlion n-tron 702-w firmware
- canonical/redlion n-tron 702-w
- canonical/redlion n-tron 702m12-w firmware
- canonical/redlion n-tron 702m12-w
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/14.04
- version/canonical ubuntu linux/16.04
- vendor/red lion
- canonical/red lion n-tron 702-w
- canonical/red lion n-tron 702m12-w
- package-manager/debian