A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
Affects: BusyBox v1.36.1 and v1.37.0 (likely affects earlier versions too) CVSS: 9.3 (CRITICAL) Component: dataextractall.c in tar extraction - hardlink and symlink handling
Description: Hardlink entries in tar archives are created without validation of the linktarget path. This allows modification of files outside the extraction directory and bypasses existing path traversal mitigations. This vulnerability has higher impact than the path traversal issue as it does not rely on relative paths or the current working directory.
Technical Details: - Hardlink entries can point to absolute paths like /etc/passwd - Symlink entries suffer from the same root cause (missing linktarget validation) - When extraction is performed with elevated privileges, attackers can modify critical system files
Impact: Arbitrary file modification outside extraction directory, privilege escalation when combined with elevated extraction permissions, bypass of path traversal protections.
Note: While hardlinks and symlinks share the same root cause (missing linktarget validation), I'm requesting a single CVE for this issue.
On 4/24/25 3:09 AM, Albert Veli wrote: Hi,
On Wed, Apr 23, 2025 at 10:51 PM Salvatore Bonaccorso <carnil () debian org> wrote: FTR, this one has assigned CVE-2025-46394 ... FTR, this one has CVE-2024-58251 assigned. From what I can tell the latest release is busybox-1.37.0. Are these fixed in this release? If not, do you have any link to patches I can apply to fix these issues?
Regards, Albert This message was marked as spam by GMail. The ARC-Authentication-Results header indicates that the mailing list is not configured in a DMARC-compatible way. Specifically, the mailing list did not rewrite the From: header but did modify the message body, so the DKIM signature check failed. -- Sincerely, Demi Marie Obenour (she/her/hers)
On Thursday, 24 April 2025 at 17:16 Albert Veli <albert.veli () gmail com> wrote: On Wed, Apr 23, 2025 at 10:51 PM Salvatore Bonaccorso <carnil () debian org> wrote: FTR, this one has assigned CVE-2025-46394
From what I can tell the latest release is busybox-1.37.0. Are these fixed in this release? If not, do you have any link to patches I can apply to fix these issues? I re-posted the patch for CVE-2025-46394 to https://lists.busybox.net/pipermail/busybox/2025-April/091461.html
I was sceptical about the isatty() call but it was requested by others on the list
-- Ian
Any email and files/attachments transmitted with it are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.
Hi,
On Wed, Apr 23, 2025 at 10:51 PM Salvatore Bonaccorso <carnil () debian org> wrote: FTR, this one has assigned CVE-2025-46394 ... FTR, this one has CVE-2024-58251 assigned.
From what I can tell the latest release is busybox-1.37.0. Are these fixed in this release? If not, do you have any link to patches I can apply to fix these issues?
Regards, Albert
Hi,
On Wed, Apr 23, 2025 at 05:38:17PM +0200, Ricardo Branco wrote: I reported this one in busybox's netstat a year ago:
https://bugs.busybox.net/showbug.cgi?id=15922
The whole code needs a security audit for ANSI escapes like this. FTR, this one has CVE-2024-58251 assigned.
Regards, Salvatore
Hi,
On Wed, Apr 23, 2025 at 02:11:44PM +0000, Ian Norton wrote: https://bugs.busybox.net/showbug.cgi?id=16018 (awaiting CVE)
Busybox's cpio and tar tools will print un-escaped filenames when listing and unpacking cpio and tar files. Malicious files containing filenames with terminal escapes can be used to mask or modify earlier or later files in the archive from anyone running busybox tar or cpio from a terminal. FTR, this one has assigned CVE-2025-46394 .
Regards, Salvatore
Ian Norton <Ian.Norton () entrust com>, 2025-04-23 14:11: https://security-tracker.debian.org/tracker/CVE-2023-39810
see also https://lists.busybox.net/pipermail/busybox/2024-July/090851.html
But it seems busybox committed a different patch, which looks good: https://git.busybox.net/busybox/commit/?id=9a8796436b9b0641 ("archival: disallow path traversals (CVE-2023-39810)")
The essence of the patch is:
+#if ENABLEFEATUREPATHTRAVERSALPROTECTION + / Strip leading "/" and up to last "/../" path component / + dstname = (char )stripunsafeprefix(dstname); +#endif
-- Jakub Wilk
A vulnerability classified as problematic was found in Netis WF-2404 1.1.124EN. Affected by this vulnerability is an unknown functionality of the component BusyBox Shell. The manipulation leads to cleartext storage of sensitive information. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.
https://bugs.busybox.net/showbug.cgi?id=15216
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvari function
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvars function
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handlespecial function
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nextinputfile function
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function
An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hashinit function
A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function
An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.
A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given
An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.
The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem read/write permissions to the anonymous user. A remote user within range of the open access point on the drone may utilize the anonymous user of the FTP server to read arbitrary files, such as images and video recorded by the device, or to replace system files such as /etc/shadow to gain further access to the device. Furthermore, the DBPOWER U818A WIFI quadcopter drone uses BusyBox 1.20.2, which was released in 2012, and may be vulnerable to other known BusyBox vulnerabilities.
Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file".
archival/libarchive/decompressunlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation.
A vulnerability was found in Bundler. Bundler allows the user to specify sources from which Ruby gems are installed. If a secondary source is specified, even if scoped to a specific gem, that source is silently applied to all declared gems. This allows an attacker to introduce arbitrary code into an application via gem name collision on the secondary source, which will unexpectedly (and without warning) take priority over the primary source.
CVE request:
http://seclists.org/oss-sec/2016/q4/18
CVE assignment:
http://seclists.org/oss-sec/2016/q4/20
References:
http://seclists.org/oss-sec/2016/q4/25