Detections
Analytics
Amazon Linux AMI : busybox (ALAS-2012-103)
high Nessus Plugin ID 69593
Language:
Synopsis
The remote Amazon Linux AMI host is missing a security update.Description
A buffer underflow flaw was found in the way the uncompress utility of BusyBox expanded certain archive files compressed using Lempel-Ziv compression. If a user were tricked into expanding a specially crafted archive file with uncompress, it could cause BusyBox to crash or, potentially, execute arbitrary code with the privileges of the user running BusyBox. (CVE-2006-1168)The BusyBox DHCP client, udhcpc, did not sufficiently sanitize certain options provided in DHCP server replies, such as the client hostname.
A malicious DHCP server could send such an option with a specially crafted value to a DHCP client. If this option's value was saved on the client system, and then later insecurely evaluated by a process that assumes the option is trusted, it could lead to arbitrary code execution with the privileges of that process. (CVE-2011-2716)
Solution
Run 'yum update busybox' to update your system.See Also
Plugin Details
Severity: High
ID: 69593
File Name: ala_ALAS-2012-103.nasl
Version: 1.6
Type: local
Agent: unix
Published: 9/4/2013
Updated: 4/18/2018
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/o:amazon:linux, p-cpe:/a:amazon:linux:busybox-petitboot, p-cpe:/a:amazon:linux:busybox
Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list
Patch Publication Date: 7/5/2012
Reference Information
CVE: CVE-2006-1168, CVE-2011-2716