BusyBox: Multiple vulnerabilities — GLSA 201503-13

Multiple vulnerabilities have been found in BusyBox, allowing context dependent attackers to load arbitrary kernel modules, execute arbitrary files, or cause a Denial of Service condition.

Affected packages

sys-apps/busybox on all architectures
Affected versions < 1.23.1
Unaffected versions >= 1.23.1

Background

BusyBox is set of tools for embedded systems and is a replacement for GNU Coreutils.

Description

Multiple vulnerabilities have been discovered in BusyBox. Please review the CVE identifiers referenced below for details.

Impact

A context-dependent attacker can load kernel modules without privileges by nullifying enforced module prefixes. Execution of arbitrary files or a Denial of Service can be caused through the included vulnerable LZO library.

Workaround

There is no known workaround at this time.

Resolution

All BusyBox users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=sys-apps/busybox-1.23.1"
 

References

Release date
March 29, 2015

Latest revision
March 29, 2015: 1

Severity
normal

Exploitable
local, remote

Bugzilla entries