Lucene search

[email protected]NVD:CVE-2017-16544

HistoryNov 20, 2017 - 3:29 p.m.

CVE-2017-16544

2017-11-2015:29:00

CWE-94

[email protected]

web.nvd.nist.gov

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

77.0%

JSON

In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.

Affected configurations

NVD

Node

busyboxbusyboxRange≤1.27.2

Node

debiandebian_linuxMatch8.0

debiandebian_linuxMatch9.0

Node

vmwareesxiMatch6.0

vmwareesxiMatch6.0-

vmwareesxiMatch6.01

vmwareesxiMatch6.01a

vmwareesxiMatch6.01b

vmwareesxiMatch6.02

vmwareesxiMatch6.03

vmwareesxiMatch6.03a

vmwareesxiMatch6.0600-201504401

vmwareesxiMatch6.0600-201505401

vmwareesxiMatch6.0600-201507101

vmwareesxiMatch6.0600-201507102

vmwareesxiMatch6.0600-201507401

vmwareesxiMatch6.0600-201507402

vmwareesxiMatch6.0600-201507403

vmwareesxiMatch6.0600-201507404

vmwareesxiMatch6.0600-201507405

vmwareesxiMatch6.0600-201507406

vmwareesxiMatch6.0600-201507407

vmwareesxiMatch6.0600-201509101

vmwareesxiMatch6.0600-201509102

vmwareesxiMatch6.0600-201509201

vmwareesxiMatch6.0600-201509202

vmwareesxiMatch6.0600-201509203

vmwareesxiMatch6.0600-201509204

vmwareesxiMatch6.0600-201509205

vmwareesxiMatch6.0600-201509206

vmwareesxiMatch6.0600-201509207

vmwareesxiMatch6.0600-201509208

vmwareesxiMatch6.0600-201509209

vmwareesxiMatch6.0600-201509210

vmwareesxiMatch6.0600-201510401

vmwareesxiMatch6.0600-201511401

vmwareesxiMatch6.0600-201601101

vmwareesxiMatch6.0600-201601102

vmwareesxiMatch6.0600-201601401

vmwareesxiMatch6.0600-201601402

vmwareesxiMatch6.0600-201601403

vmwareesxiMatch6.0600-201601404

vmwareesxiMatch6.0600-201601405

vmwareesxiMatch6.0600-201602401

vmwareesxiMatch6.0600-201603101

vmwareesxiMatch6.0600-201603102

vmwareesxiMatch6.0600-201603201

vmwareesxiMatch6.0600-201603202

vmwareesxiMatch6.0600-201603203

vmwareesxiMatch6.0600-201603204

vmwareesxiMatch6.0600-201603205

vmwareesxiMatch6.0600-201603206

vmwareesxiMatch6.0600-201603207

vmwareesxiMatch6.0600-201603208

vmwareesxiMatch6.0600-201605401

vmwareesxiMatch6.0600-201608101

vmwareesxiMatch6.0600-201608401

vmwareesxiMatch6.0600-201608402

vmwareesxiMatch6.0600-201608403

vmwareesxiMatch6.0600-201608404

vmwareesxiMatch6.0600-201608405

vmwareesxiMatch6.0600-201610410

vmwareesxiMatch6.0600-201611401

vmwareesxiMatch6.0600-201611402

vmwareesxiMatch6.0600-201611403

vmwareesxiMatch6.0600-201702101

vmwareesxiMatch6.0600-201702102

vmwareesxiMatch6.0600-201702201

vmwareesxiMatch6.0600-201702202

vmwareesxiMatch6.0600-201702203

vmwareesxiMatch6.0600-201702204

vmwareesxiMatch6.0600-201702205

vmwareesxiMatch6.0600-201702206

vmwareesxiMatch6.0600-201702207

vmwareesxiMatch6.0600-201702208

vmwareesxiMatch6.0600-201702209

vmwareesxiMatch6.0600-201702210

vmwareesxiMatch6.0600-201702211

vmwareesxiMatch6.0600-201702212

vmwareesxiMatch6.0600-201703401

vmwareesxiMatch6.0600-201706101

vmwareesxiMatch6.0600-201706102

vmwareesxiMatch6.0600-201706103

vmwareesxiMatch6.0600-201706401

vmwareesxiMatch6.0600-201706402

vmwareesxiMatch6.0600-201706403

vmwareesxiMatch6.0600-201710301

vmwareesxiMatch6.0600-201811001

vmwareesxiMatch6.0600-201811401

vmwareesxiMatch6.0600-201903001

vmwareesxiMatch6.0600-201905001

vmwareesxiMatch6.0600-201909001

vmwareesxiMatch6.5-

vmwareesxiMatch6.5650-201701001

vmwareesxiMatch6.5650-201703001

vmwareesxiMatch6.5650-201703002

vmwareesxiMatch6.5650-201704001

vmwareesxiMatch6.5650-201707101

vmwareesxiMatch6.5650-201707102

vmwareesxiMatch6.5650-201707103

vmwareesxiMatch6.5650-201707201

vmwareesxiMatch6.5650-201707202

vmwareesxiMatch6.5650-201707203

vmwareesxiMatch6.5650-201707204

vmwareesxiMatch6.5650-201707205

vmwareesxiMatch6.5650-201707206

vmwareesxiMatch6.5650-201707207

vmwareesxiMatch6.5650-201707208

vmwareesxiMatch6.5650-201707209

vmwareesxiMatch6.5650-201707210

vmwareesxiMatch6.5650-201707211

vmwareesxiMatch6.5650-201707212

vmwareesxiMatch6.5650-201707213

vmwareesxiMatch6.5650-201707214

vmwareesxiMatch6.5650-201707215

vmwareesxiMatch6.5650-201707216

vmwareesxiMatch6.5650-201707217

vmwareesxiMatch6.5650-201707218

vmwareesxiMatch6.5650-201707219

vmwareesxiMatch6.5650-201707220

vmwareesxiMatch6.5650-201707221

vmwareesxiMatch6.5650-201710001

vmwareesxiMatch6.5650-201712001

vmwareesxiMatch6.5650-201803001

vmwareesxiMatch6.5650-201806001

vmwareesxiMatch6.5650-201808001

vmwareesxiMatch6.5650-201810001

vmwareesxiMatch6.5650-201810002

vmwareesxiMatch6.5650-201811001

vmwareesxiMatch6.5650-201811002

vmwareesxiMatch6.5650-201811301

vmwareesxiMatch6.5650-201901001

vmwareesxiMatch6.5650-201903001

vmwareesxiMatch6.5650-201905001

vmwareesxiMatch6.7-

vmwareesxiMatch6.7670-201806001

vmwareesxiMatch6.7670-201807001

vmwareesxiMatch6.7670-201808001

vmwareesxiMatch6.7670-201810001

vmwareesxiMatch6.7670-201810101

vmwareesxiMatch6.7670-201810102

vmwareesxiMatch6.7670-201810103

vmwareesxiMatch6.7670-201810201

vmwareesxiMatch6.7670-201810202

vmwareesxiMatch6.7670-201810203

vmwareesxiMatch6.7670-201810204

vmwareesxiMatch6.7670-201810205

vmwareesxiMatch6.7670-201810206

vmwareesxiMatch6.7670-201810207

vmwareesxiMatch6.7670-201810208

vmwareesxiMatch6.7670-201810209

vmwareesxiMatch6.7670-201810210

vmwareesxiMatch6.7670-201810211

vmwareesxiMatch6.7670-201810212

vmwareesxiMatch6.7670-201810213

vmwareesxiMatch6.7670-201810214

vmwareesxiMatch6.7670-201810215

vmwareesxiMatch6.7670-201810216

vmwareesxiMatch6.7670-201810217

vmwareesxiMatch6.7670-201810218

vmwareesxiMatch6.7670-201810219

vmwareesxiMatch6.7670-201810220

vmwareesxiMatch6.7670-201810221

vmwareesxiMatch6.7670-201810222

vmwareesxiMatch6.7670-201810223

vmwareesxiMatch6.7670-201810224

vmwareesxiMatch6.7670-201810225

vmwareesxiMatch6.7670-201810226

vmwareesxiMatch6.7670-201810227

vmwareesxiMatch6.7670-201810228

vmwareesxiMatch6.7670-201810229

vmwareesxiMatch6.7670-201810230

vmwareesxiMatch6.7670-201810231

vmwareesxiMatch6.7670-201810232

vmwareesxiMatch6.7670-201810233

vmwareesxiMatch6.7670-201810234

vmwareesxiMatch6.7670-201811001

vmwareesxiMatch6.7670-201901001

vmwareesxiMatch6.7670-201901401

vmwareesxiMatch6.7670-201901402

vmwareesxiMatch6.7670-201901403

vmwareesxiMatch6.7670-201903001

vmwareesxiMatch6.7670-201904001

Node

redlionn-tron_702-w_firmware

AND

redlionn-tron_702-wMatch-

Node

redlionn-tron_702m12-w_firmware

AND

redlionn-tron_702m12-wMatch-

Node

canonicalubuntu_linuxMatch14.04lts

canonicalubuntu_linuxMatch16.04lts

References

packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html

packetstormsecurity.com/files/154536/VMware-Security-Advisory-2019-0013.html

packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html

seclists.org/fulldisclosure/2019/Jun/18

seclists.org/fulldisclosure/2019/Sep/7

seclists.org/fulldisclosure/2020/Aug/20

seclists.org/fulldisclosure/2020/Mar/15

seclists.org/fulldisclosure/2020/Sep/6

seclists.org/fulldisclosure/2021/Aug/21

seclists.org/fulldisclosure/2021/Jan/39

seclists.org/fulldisclosure/2022/Jun/36

www.vmware.com/security/advisories/VMSA-2019-0013.html

git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e7d9c11e8

lists.debian.org/debian-lts-announce/2018/07/msg00037.html

lists.debian.org/debian-lts-announce/2021/02/msg00020.html

seclists.org/bugtraq/2019/Jun/14

seclists.org/bugtraq/2019/Sep/7

us-cert.cisa.gov/ics/advisories/icsa-20-240-01

usn.ubuntu.com/3935-1/

www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-vulnerability/

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

77.0%

JSON

Related for NVD:CVE-2017-16544

veracode1 alpinelinux1 cve1 debiancve1 archlinux2 ubuntucve1 osv3 redhatcve1 prion1 cvelist1 nessus14 gentoo1 vmware2 packetstorm8 zdt2 ics1 cloudfoundry1 ubuntu1 openvas7 debian2 ibm1 suse1