BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.
References
| Link | Resource |
|---|---|
| https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch | Mailing List Patch Vendor Advisory |
| https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch | Mailing List Patch Vendor Advisory |
| https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661 | Exploit Patch Vendor Advisory |
| https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch | Mailing List Patch Vendor Advisory |
| https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch | Mailing List Patch Vendor Advisory |
| https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661 | Exploit Patch Vendor Advisory |
Configurations
History
21 Nov 2024, 06:57
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch - Mailing List, Patch, Vendor Advisory | |
| References | () https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch - Mailing List, Patch, Vendor Advisory | |
| References | () https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661 - Exploit, Patch, Vendor Advisory |
Information
Published : 2022-04-03 21:15
Updated : 2024-11-21 06:57
NVD link : CVE-2022-28391
Mitre link : CVE-2022-28391
CVE.ORG link : CVE-2022-28391
JSON object : View
Products Affected
busybox
- busybox
CWE