[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <068a922d-d77d-45d2-9b18-e07e41c9a907@suse.de>
Date: Wed, 23 Apr 2025 17:38:17 +0200
From: Ricardo Branco <rbranco@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: vulnerabilities in busybox tar and cpio tools
I reported this one in busybox's netstat a year ago:
https://bugs.busybox.net/show_bug.cgi?id=15922
The whole code needs a security audit for ANSI escapes like this.
Best,
R
On 4/23/25 4:11 PM, Ian Norton wrote:
> https://bugs.busybox.net/show_bug.cgi?id=16018 (awaiting CVE)
>
> Busybox's cpio and tar tools will print un-escaped filenames when listing and unpacking
> cpio and tar files. Malicious files containing filenames with terminal escapes can be used
> to mask or modify earlier or later files in the archive from anyone running busybox tar or cpio
> from a terminal.
>
> see also https://lists.busybox.net/pipermail/busybox/2024-July/090806.html
>
>
> https://security-tracker.debian.org/tracker/CVE-2023-39810
>
> A unpacking a cpio archive can escape the working directory. Due to #16018 it is possible to
> mask these traversals from anyone using cpio to inspect a file before unpacking.
>
> see also https://lists.busybox.net/pipermail/busybox/2024-July/090851.html
>
>
>
>
> Any email and files/attachments transmitted with it are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
