A vulnerability was found in Bundler. Bundler allows the user to specify sources from which Ruby gems are installed. If a secondary source is specified, even if scoped to a specific gem, that source is silently applied to all declared gems. This allows an attacker to introduce arbitrary code into an application via gem name collision on the secondary source, which will unexpectedly (and without warning) take priority over the primary source.
CVE request:
http://seclists.org/oss-sec/2016/q4/18
CVE assignment:
http://seclists.org/oss-sec/2016/q4/20
References:
http://seclists.org/oss-sec/2016/q4/25
A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AWK script.
Affects: BusyBox v1.36.1 and v1.37.0 (likely affects earlier versions too) CVSS: 9.3 (CRITICAL) Component: dataextractall.c in tar extraction - hardlink and symlink handling
Description: Hardlink entries in tar archives are created without validation of the linktarget path. This allows modification of files outside the extraction directory and bypasses existing path traversal mitigations. This vulnerability has higher impact than the path traversal issue as it does not rely on relative paths or the current working directory.
Technical Details: - Hardlink entries can point to absolute paths like /etc/passwd - Symlink entries suffer from the same root cause (missing linktarget validation) - When extraction is performed with elevated privileges, attackers can modify critical system files
Impact: Arbitrary file modification outside extraction directory, privilege escalation when combined with elevated extraction permissions, bypass of path traversal protections.
Note: While hardlinks and symlinks share the same root cause (missing linktarget validation), I'm requesting a single CVE for this issue.
This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the libarchive component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of the current user.
A vulnerability was found in Bundler. Bundler allows the user to specify sources from which Ruby gems are installed. If a secondary source is specified, even if scoped to a specific gem, that source is silently applied to all declared gems. This allows an attacker to introduce arbitrary code into an application via gem name collision on the secondary source, which will unexpectedly (and without warning) take priority over the primary source.
CVE request:
http://seclists.org/oss-sec/2016/q4/18
CVE assignment:
http://seclists.org/oss-sec/2016/q4/20
References:
http://seclists.org/oss-sec/2016/q4/25