Detections
Analytics
Scientific Linux Security Update : busybox on SL6.x i386/x86_64 (20131121)
high Nessus Plugin ID 71295
Language:
Synopsis
The remote Scientific Linux host is missing one or more security updates.Description
It was found that the mdev BusyBox utility could create certain directories within /dev with world-writable permissions. A local unprivileged user could use this flaw to manipulate portions of the /dev directory tree. (CVE-2013-1813)This update also fixes the following bugs :
- Previously, due to a too eager string size optimization on the IBM System z architecture, the 'wc' BusyBox command failed after processing standard input with the following error :
wc: : No such file or directory
This bug was fixed by disabling the string size optimization and the 'wc' command works properly on IBM System z architectures.
- Prior to this update, the 'mknod' command was unable to create device nodes with a major or minor number larger than 255. Consequently, the kdump utility failed to handle such a device. The underlying source code has been modified, and it is now possible to use the 'mknod' command to create device nodes with a major or minor number larger than 255.
- If a network installation from an NFS server was selected, the 'mount' command used the UDP protocol by default. If only TCP mounts were supported by the server, this led to a failure of the mount command. As a result, Anaconda could not continue with the installation. This bug is now fixed and NFS mount operations default to the TCP protocol.
Solution
Update the affected busybox and / or busybox-petitboot packages.See Also
Plugin Details
Severity: High
ID: 71295
File Name: sl_20131121_busybox_on_SL6_x.nasl
Version: 1.5
Type: local
Agent: unix
Published: 12/10/2013
Updated: 1/14/2021
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.2
Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:fermilab:scientific_linux:busybox, p-cpe:/a:fermilab:scientific_linux:busybox-petitboot, x-cpe:/o:fermilab:scientific_linux
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Patch Publication Date: 11/21/2013
Vulnerability Publication Date: 11/23/2013
Reference Information
CVE: CVE-2013-1813