CVE-2022-28391
First published: Sun Apr 03 2022(Updated: )
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Busybox Busybox | <=1.35.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this BusyBox vulnerability?
The vulnerability ID for this BusyBox vulnerability is CVE-2022-28391.
How severe is the CVE-2022-28391 vulnerability?
The severity of the CVE-2022-28391 vulnerability is high with a severity value of 8.8.
How does BusyBox through version 1.35.0 allow remote attackers to execute arbitrary code?
BusyBox through version 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal.
What can remote attackers do to exploit the CVE-2022-28391 vulnerability in BusyBox?
Remote attackers can execute arbitrary code or choose to change the terminal's colors by exploiting the CVE-2022-28391 vulnerability in BusyBox.
Where can I find more information about the CVE-2022-28391 vulnerability in BusyBox?
You can find more information about the CVE-2022-28391 vulnerability in BusyBox at the following references: [Reference 1](https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch), [Reference 2](https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch), [Reference 3](https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661).
- collector/nvd-index
- agent/severity
- agent/references
- agent/author
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/remedy
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/busybox
- canonical/busybox busybox
- version/busybox busybox/1.35.0