The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4019 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4019-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     January 19, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : busybox     Version        : 1:1.30.1-6+deb11u1     CVE ID         : CVE-2021-28831 CVE-2021-42374 CVE-2021-42378 CVE-2021-42379                      CVE-2021-42380 CVE-2021-42381 CVE-2021-42382 CVE-2021-42384                      CVE-2021-42385 CVE-2021-42386 CVE-2022-48174 CVE-2023-42364                      CVE-2023-42365     Debian Bug     : 985674 999567 1059049 1059051 1059052

    Multiple vulnerabilities have been found in BusyBox, a lightweight     single-executable containing various Unix utilities, which potentially     allow attackers to cause denial of service, information leakage, or     arbitrary code execution through malformed gzip data, crafted LZMA     input or crafted awk patterns.

    CVE-2021-28831

        decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit         on the huft_build result pointer, with a resultant invalid free or         segmentation fault, via malformed gzip data.

    CVE-2021-42374

        An out-of-bounds heap read in Busybox's unlzma applet leads to         information leak and denial of service when crafted LZMA-compressed         input is decompressed. This can be triggered by any applet/format that

    CVE-2021-42378

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         getvar_i function

    CVE-2021-42379

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         next_input_file function

    CVE-2021-42380

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         clrvar function

    CVE-2021-42381

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         hash_init function

    CVE-2021-42382

        use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         getvar_s function

    CVE-2021-42384

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         handle_special function

    CVE-2021-42385

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         evaluate function

    CVE-2021-42386

        A use-after-free in Busybox's awk applet leads to denial of service and         possibly code execution when processing a crafted awk pattern in the         nvalloc function

    CVE-2022-48174

        There is a stack overflow vulnerability in ash.c:6030 in busybox before         1.35. In the environment of Internet of Vehicles, this vulnerability can         be executed from command to arbitrary code execution.

    CVE-2023-42364

        A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to         cause a denial of service via a crafted awk pattern in the awk.c         evaluate function.

    CVE-2023-42365

        A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a         crafted awk pattern in the awk.c copyvar function.

    For Debian 11 bullseye, these problems have been fixed in version     1:1.30.1-6+deb11u1.

    We recommend that you upgrade your busybox packages.

    For the detailed security status of busybox please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/busybox

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-4019 : busybox - security update

critical Nessus Plugin ID 214387

Version 1.1