Multiple BusyBox Security Bugs Threaten Embedded Linux Devices

guest · Nov 9, 2021

Multiple BusyBox Security Bugs Threaten Embedded Linux Devices
...used in many OT and IoT environments
November 9, 2021
https://threatpost.com/busybox-security-bugs-linux-devices/176098/

Researchers have discovered 14 critical vulnerabilities in a popular program used in embedded Linux applications, all of which allow for denial of service (DoS) and 10 that also enable remote code execution (RCE), they said.

One of the flaws also could allow devices to leak info, according to researchers from JFrog Security and Claroty Research, in a report shared with Threatpost on Tuesday.
Click to expand...

Touted as a “Swiss Army Knife” of embedded Linux, BusyBox is comprised of useful Unix utilities called applets that are packaged as a single executable. The program includes a full-fledged shell, a DHCP client/server, and small utilities such as cp, ls, grep and others.

The discovery of the flaws are significant because of the proliferation of BusyBox not just for the embedded Linux world, but also for numerous Linux applications outside of devices, Menashe said in an email to Threatpost.
Click to expand...

Overall, 40 percent of the firmware using BusyBox that researchers inspected include a BusyBox executable file linked with one of the affected applets, making the problem “extremely widespread among Linux-based embedded firmware,” they wrote. However, the vulnerabilities don’t currently pose a critical threat to affected devices for a number of reasons, researchers noted in the analysis, including the aforementioned exploit complexity.
Click to expand...

JFrog: Unboxing BusyBox – 14 new vulnerabilities uncovered by Claroty and JFrog

As part of our commitment to improving open-source software security, Claroty’s Team82 and JFrog collaborated on a vulnerability research project examining BusyBox. Using static and dynamic techniques, Claroty’s Team82 and JFrog discovered 14 vulnerabilities affecting the latest version of BusyBox. All vulnerabilities were privately disclosed and fixed by BusyBox in version 1.34.0, which was released Aug. 19.

In most cases, the expected impact of these issues is denial of service (DoS). However, in rarer cases, these issues can also lead to information leaks and possibly remote code execution.
Click to expand...

All 14 vulnerabilities have been fixed in BusyBox 1.34.0 (direct download link) and users are urged to upgrade.
Click to expand...

Log in or Sign up

Multiple BusyBox Security Bugs Threaten Embedded Linux Devices

guest Guest

Log in or Sign up

Multiple BusyBox Security Bugs Threaten Embedded Linux Devices

guest Guest

Useful Searches