The version of busybox installed on the remote host is prior to 1.34.1-1.13. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1558 advisory.

    A flaw was found in BusyBox, where it did not properly sanitize while processing a crafted shell command,     leading to a denial of service. The highest threat from this vulnerability is to system availability.
    (CVE-2021-42376)

    A flaw was found in BusyBox, where it did not properly sanitize while processing a crafted awk pattern,     leading to possible code execution. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-42378)

    A flaw was found in BusyBox, where it did not properly sanitize while processing a crafted awk pattern in     the next_input_file function, leading to possible code execution. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-42379)

    A flaw was found in BusyBox, where it did not properly sanitize while processing a crafted awk pattern in     the handle_special function, leading to possible code execution. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-42384)

    A flaw was found in BusyBox, where it did not properly sanitize while processing a crafted awk pattern in     the evaluate function, leading to possible code execution. The highest threat from this vulnerability is     to confidentiality, integrity, as well as system availability. (CVE-2021-42385)

    A flaw was found in BusyBox, where it did not properly sanitize while processing a crafted awk pattern in     the nvalloc function, leading to possible code execution. The highest threat from this vulnerability is to     confidentiality, integrity, as well as system availability. (CVE-2021-42386)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux AMI : busybox (ALAS-2022-1558)

high Nessus Plugin ID 156867

Version 1.4

Version 1.3

Version 1.4 Dec 12, 2024, 9:55 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202412120955
Version 1.3 Feb 21, 2023, 1:55 AM Regenerated based on advisory update Plugin Feed: 202302210155