util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors.

Updated busybox packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

BusyBox provides a single binary that includes versions of a large number of system commands, including a shell. This can be very useful for recovering from certain types of system failures, particularly those involving broken shared libraries.

It was found that the mdev BusyBox utility could create certain directories within /dev with world-writable permissions. A local unprivileged user could use this flaw to manipulate portions of the /dev directory tree. (CVE-2013-1813)

This update also fixes the following bugs :

* Previously, due to a too eager string size optimization on the IBM System z architecture, the 'wc' BusyBox command failed after processing standard input with the following error :

wc: : No such file or directory

This bug was fixed by disabling the string size optimization and the 'wc' command works properly on IBM System z architectures. (BZ#820097)

* Prior to this update, the 'mknod' command was unable to create device nodes with a major or minor number larger than 255.
Consequently, the kdump utility failed to handle such a device. The underlying source code has been modified, and it is now possible to use the 'mknod' command to create device nodes with a major or minor number larger than 255. (BZ#859817)

* If a network installation from an NFS server was selected, the 'mount' command used the UDP protocol by default. If only TCP mounts were supported by the server, this led to a failure of the mount command. As a result, Anaconda could not continue with the installation. This bug is now fixed and NFS mount operations default to the TCP protocol. (BZ#855832)

All busybox users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

It was found that the mdev BusyBox utility could create certain directories within /dev with world-writable permissions. A local unprivileged user could use this flaw to manipulate portions of the /dev directory tree. (CVE-2013-1813)

This update also fixes the following bugs :

  - Previously, due to a too eager string size optimization     on the IBM System z architecture, the 'wc' BusyBox     command failed after processing standard input with the     following error :

wc: : No such file or directory

This bug was fixed by disabling the string size optimization and the 'wc' command works properly on IBM System z architectures.

  - Prior to this update, the 'mknod' command was unable to     create device nodes with a major or minor number larger     than 255. Consequently, the kdump utility failed to     handle such a device. The underlying source code has     been modified, and it is now possible to use the 'mknod'     command to create device nodes with a major or minor     number larger than 255.

  - If a network installation from an NFS server was     selected, the 'mount' command used the UDP protocol by     default. If only TCP mounts were supported by the     server, this led to a failure of the mount command. As a     result, Anaconda could not continue with the     installation. This bug is now fixed and NFS mount     operations default to the TCP protocol.

The remote host is affected by the vulnerability described in GLSA-201312-02 (BusyBox: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in BusyBox. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send a specially crafted DHCP request to       possibly execute arbitrary code or cause Denial of Service.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1732 advisory.

    [1:1.15.1-20]
    - Resolves: #855832       'Installation from NFS: That directory could not be mounted from the server'       by switching NFS mount default from UDP to TCP.
      There was another place (in uclibc this time) which used UDP.

    [1:1.15.1-19]
    - Resolves: #1015010       'busybox: insecure directory permissions in /dev'

    [1:1.15.1-18]
    - Resolves: #855832       'Installation from NFS: That directory could not be mounted from the server'       by switching NFS mount default from UDP to TCP.

    [1:1.15.1-17]
    - Resolves: #820097
    - 's390x: wc: : No such file or directory'

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
79174	CentOS 6 : busybox (CESA-2013:1732)	Nessus	CentOS Local Security Checks	high
71295	Scientific Linux Security Update : busybox on SL6.x i386/x86_64 (20131121)	Nessus	Scientific Linux Local Security Checks	high
71168	GLSA-201312-02 : BusyBox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
71113	Oracle Linux 6 : busybox (ELSA-2013-1732)	Nessus	Oracle Linux Local Security Checks	high
71018	RHEL 6 : busybox (RHSA-2013:1732)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2013-1813

critical

Tenable Plugins

high

high

high

high

high