6.8

CVE-2011-2716

The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) TFTP_SERVER_NAME host name options.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
T-mobile ≫ Tm-ac1900 Version3.0.0.4.376_3169
Busybox ≫ Busybox Version <= 1.19.4
Busybox ≫ Busybox Version0.60.5
Busybox ≫ Busybox Version1.00
Busybox ≫ Busybox Version1.0.0 Updatepre1
Busybox ≫ Busybox Version1.0.0 Updatepre10
Busybox ≫ Busybox Version1.0.0 Updatepre2
Busybox ≫ Busybox Version1.0.0 Updatepre3
Busybox ≫ Busybox Version1.0.0 Updatepre4
Busybox ≫ Busybox Version1.0.0 Updatepre5
Busybox ≫ Busybox Version1.0.0 Updatepre6
Busybox ≫ Busybox Version1.0.0 Updatepre7
Busybox ≫ Busybox Version1.0.0 Updatepre8
Busybox ≫ Busybox Version1.0.0 Updatepre9
Busybox ≫ Busybox Version1.0.0 Updaterc1
Busybox ≫ Busybox Version1.0.0 Updaterc2
Busybox ≫ Busybox Version1.0.0 Updaterc3
Busybox ≫ Busybox Version1.01
Busybox ≫ Busybox Version1.1.0
Busybox ≫ Busybox Version1.1.0 Updatepre1
Busybox ≫ Busybox Version1.1.1
Busybox ≫ Busybox Version1.1.2
Busybox ≫ Busybox Version1.1.3
Busybox ≫ Busybox Version1.2.0
Busybox ≫ Busybox Version1.2.1
Busybox ≫ Busybox Version1.2.2
Busybox ≫ Busybox Version1.2.2.1
Busybox ≫ Busybox Version1.3.0
Busybox ≫ Busybox Version1.3.1
Busybox ≫ Busybox Version1.3.2
Busybox ≫ Busybox Version1.4.0
Busybox ≫ Busybox Version1.4.1
Busybox ≫ Busybox Version1.4.2
Busybox ≫ Busybox Version1.5.0
Busybox ≫ Busybox Version1.5.1
Busybox ≫ Busybox Version1.6.0
Busybox ≫ Busybox Version1.6.1
Busybox ≫ Busybox Version1.7.0
Busybox ≫ Busybox Version1.7.1
Busybox ≫ Busybox Version1.7.2
Busybox ≫ Busybox Version1.7.3
Busybox ≫ Busybox Version1.8.0
Busybox ≫ Busybox Version1.8.1
Busybox ≫ Busybox Version1.8.2
Busybox ≫ Busybox Version1.9.0
Busybox ≫ Busybox Version1.9.1
Busybox ≫ Busybox Version1.9.2
Busybox ≫ Busybox Version1.10.0
Busybox ≫ Busybox Version1.10.1
Busybox ≫ Busybox Version1.10.2
Busybox ≫ Busybox Version1.10.3
Busybox ≫ Busybox Version1.10.4
Busybox ≫ Busybox Version1.11.0
Busybox ≫ Busybox Version1.11.1
Busybox ≫ Busybox Version1.11.2
Busybox ≫ Busybox Version1.11.3
Busybox ≫ Busybox Version1.12.0
Busybox ≫ Busybox Version1.12.1
Busybox ≫ Busybox Version1.12.2
Busybox ≫ Busybox Version1.12.3
Busybox ≫ Busybox Version1.12.4
Busybox ≫ Busybox Version1.13.0
Busybox ≫ Busybox Version1.13.1
Busybox ≫ Busybox Version1.13.2
Busybox ≫ Busybox Version1.13.3
Busybox ≫ Busybox Version1.13.4
Busybox ≫ Busybox Version1.14.0
Busybox ≫ Busybox Version1.14.1
Busybox ≫ Busybox Version1.14.2
Busybox ≫ Busybox Version1.14.3
Busybox ≫ Busybox Version1.14.4
Busybox ≫ Busybox Version1.15.0
Busybox ≫ Busybox Version1.15.1
Busybox ≫ Busybox Version1.15.2
Busybox ≫ Busybox Version1.15.3
Busybox ≫ Busybox Version1.16.0
Busybox ≫ Busybox Version1.16.1
Busybox ≫ Busybox Version1.16.2
Busybox ≫ Busybox Version1.17.0
Busybox ≫ Busybox Version1.17.1
Busybox ≫ Busybox Version1.17.2
Busybox ≫ Busybox Version1.17.3
Busybox ≫ Busybox Version1.17.4
Busybox ≫ Busybox Version1.18.0
Busybox ≫ Busybox Version1.18.1
Busybox ≫ Busybox Version1.18.2
Busybox ≫ Busybox Version1.18.3
Busybox ≫ Busybox Version1.18.4
Busybox ≫ Busybox Version1.18.5
Busybox ≫ Busybox Version1.19.0
Busybox ≫ Busybox Version1.19.2
Busybox ≫ Busybox Version1.19.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.8% 0.756
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 3.2 10
AV:A/AC:H/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://downloads.avaya.com/css/P8/documents/100158840
http://rhn.redhat.com/errata/RHSA-2012-0810.html
http://www.mandriva.com/security/advisories?name=MDVSA-2012:129
http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html
http://seclists.org/fulldisclosure/2019/Jun/18
https://seclists.org/bugtraq/2019/Jun/14
http://seclists.org/fulldisclosure/2020/Aug/20
http://secunia.com/advisories/45363
Vendor Advisory
http://www.busybox.net/news.html
http://www.securityfocus.com/bid/48879
https://bugs.busybox.net/show_bug.cgi?id=3979
Patch
https://support.t-mobile.com/docs/DOC-21994