busybox: CVE-2017-16544: lineedit: do not tab-complete any strings which have control characters

Debian Bug report logs - #882258
busybox: CVE-2017-16544: lineedit: do not tab-complete any strings which have control characters

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: busybox: CVE-2017-16544: lineedit: do not tab-complete any strings which have control characters

Date: Mon, 20 Nov 2017 20:50:00 +0100

Source: busybox
Version: 1:1.27.2-1
Severity: grave
Tags: security

Hi,

the following vulnerability was published for busybox. I realize you
know of the issue already but just filling to have a tracking bug as
well in the BTS.

CVE-2017-16544[0]:
| In the add_match function in libbb/lineedit.c in BusyBox through
| 1.27.2, the tab autocomplete feature of the shell, used to get a list
| of filenames in a directory, does not sanitize filenames and results in
| executing any escape sequence in the terminal. This could potentially
| result in code execution, arbitrary file writes, or other attacks.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-16544
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16544
[1] https://git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e7d9c11e8

Please adjust the affected versions in the BTS as needed, only
unstable checked so far.

Regards,
Salvatore

Message #14 received at 882258@bugs.debian.org (full text, mbox, reply):

From: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>

To: 882258@bugs.debian.org

Subject: Re: Bug#882258: busybox: CVE-2017-16544: lineedit: do not tab-complete any strings which have control characters

Date: Mon, 20 Nov 2017 21:04:08 +0100

[Message part 1 (text/plain, inline)]

found 882258 1:1.20.0-7
found 882258 1:1.22.0-9+deb8u1
found 882258 1:1.22.0-19
found 882258 1:1.27.2-1
thanks

Salvatore Bonaccorso wrote...

> Please adjust the affected versions in the BTS as needed, only
> unstable checked so far.

Can help with that: All versions back to and including wheezy are
affected. Luckily the fix applies sanely everywhere, updated packages
will follow ASAP.

    Christoph

[signature.asc (application/pgp-signature, inline)]

Message #25 received at 882258-done@bugs.debian.org (full text, mbox, reply):

From: Chris Boot <bootc@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 882258-done@bugs.debian.org

Subject: Re: Bug#882258: busybox: CVE-2017-16544: lineedit: do not tab-complete any strings which have control characters

Date: Mon, 5 Feb 2018 11:52:28 +0100

[Message part 1 (text/plain, inline)]

Version: 1:1.27.2-2

Hi Salvatore,

This was fixed in the last upload of busybox but the bug wasn't closed,
sorry. I see that the security tracker has been updated already, though.

Cheers,
Chris

-- 
Chris Boot
bootc@debian.org

[signature.asc (application/pgp-signature, attachment)]

Message #30 received at 882258@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Chris Boot <bootc@debian.org>

Cc: 882258@bugs.debian.org

Subject: Re: Bug#882258: busybox: CVE-2017-16544: lineedit: do not tab-complete any strings which have control characters

Date: Mon, 5 Feb 2018 12:57:30 +0100

Hi

On Mon, Feb 05, 2018 at 11:52:28AM +0100, Chris Boot wrote:
> Version: 1:1.27.2-2
> 
> Hi Salvatore,
> 
> This was fixed in the last upload of busybox but the bug wasn't closed,
> sorry. I see that the security tracker has been updated already, though.

Thanks for the notice! Yes we did already update the tracker (which
presumalby was after we checked the 1:1.27.2-2 upload).

Regards,
Salvatore

Send a report that this bug log contains spam.