Non évaluée
An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a...
CVE-2018-20679
Première détection SecPulse
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2018-20679 busybox Corrigé dans: 1.29.3-r10
- Debian DEBIAN-CVE-2018-20679 busybox Corrigé dans: 1:1.30.1-1
Description d'origine La description telle que publiée par la source (souvent en anglais).
An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.
Références
- advisory busybox.net
- advisory usn.ubuntu.com
- patch git.busybox.net
- report bugs.busybox.net
- web packetstormsecurity.com
- web seclists.org
- web seclists.org