Ubuntu 21.10 Advisory USN-5179-1: BusyBox Remote Code Execution Risk

ubuntu

December 7, 2021

Several security issues were fixed in BusyBox.

Summary

Several security issues were fixed in BusyBox.

Software Description:

- busybox: Tiny utilities for small and embedded systems

Details:

It was discovered that BusyBox incorrectly handled certain malformed gzip

archives. If a user or automated system were tricked into processing a

specially crafted gzip archive, a remote attacker could use this issue to

cause BusyBox to crash, resulting in a denial of service, or possibly

execute arbitrary code. (CVE-2021-28831)

It was discovered that BusyBox incorrectly handled certain malformed LZMA

archives. If a user or automated system were tricked into processing a

specially crafted LZMA archive, a remote attacker could use this issue to

cause BusyBox to crash, resulting in a denial of service, or possibly

leak sensitive information. (CVE-2021-42374)

Vera Mens, Uri Katz, Tal Keren, Sharon Brizinov, and Shachar Menashe

discovered that BusyBox incorrectly handled certain awk patterns. If a user

or automated system were ...

Read the Full Advisory

Topics Covered

security advisory denial of service code execution remote attack update instructions ubuntu busybox

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
  busybox                         1:1.30.1-6ubuntu3.1
  busybox-initramfs               1:1.30.1-6ubuntu3.1
  busybox-static                  1:1.30.1-6ubuntu3.1

Ubuntu 21.04:
  busybox                         1:1.30.1-6ubuntu2.1
  busybox-initramfs               1:1.30.1-6ubuntu2.1
  busybox-static                  1:1.30.1-6ubuntu2.1

Ubuntu 20.04 LTS:
  busybox                         1:1.30.1-4ubuntu6.4
  busybox-initramfs               1:1.30.1-4ubuntu6.4
  busybox-static                  1:1.30.1-4ubuntu6.4

Ubuntu 18.04 LTS:
  busybox                         1:1.27.2-2ubuntu3.4
  busybox-initramfs               1:1.27.2-2ubuntu3.4
  busybox-static                  1:1.27.2-2ubuntu3.4

In general, a standard system update will make all the necessary changes.