8.8
CVE-2017-16544
- EPSS 6.24%
- Veröffentlicht 20.11.2017 15:29:00
- Zuletzt bearbeitet 13.05.2026 00:24:29
- Erkennungen
LoginIn the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version 8.0
Debian ≫ Debian Linux Version 9.0
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 6.24% | 0.926 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| NIST | 6.5 | 8 | 6.4 |
AV:N/AC:L/Au:S/C:P/I:P/A:P
|
| CISA-ADP | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
CWE-94 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
http://seclists.org/fulldisclosure/2019/Jun/18
https://seclists.org/bugtraq/2019/Jun/14
http://seclists.org/fulldisclosure/2020/Aug/20
http://seclists.org/fulldisclosure/2020/Mar/15
http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html
http://seclists.org/fulldisclosure/2019/Sep/7
https://seclists.org/bugtraq/2019/Sep/7
http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html
http://seclists.org/fulldisclosure/2022/Jun/36
https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html
https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html
https://usn.ubuntu.com/3935-1/
http://packetstormsecurity.com/files/154536/VMware-Security-Advisory-2019-0013.html
http://seclists.org/fulldisclosure/2020/Sep/6
http://seclists.org/fulldisclosure/2021/Aug/21
http://seclists.org/fulldisclosure/2021/Jan/39
http://www.vmware.com/security/advisories/VMSA-2019-0013.html
https://git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e7d9c11e8
https://us-cert.cisa.gov/ics/advisories/icsa-20-240-01
https://www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-vulnerability/