Published: 23/11/2013 Updated: 27/08/2020

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

VMScore: 641

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

util-linux/mdev.c in BusyBox prior to 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat enterprise linux 6.0
t-mobile tm-ac1900 3.0.0.4.376_3169
busybox busybox 0.38
busybox busybox 0.46
busybox busybox 0.47
busybox busybox 0.60.1
busybox busybox 0.60.2
busybox busybox 0.60.3
busybox busybox 1.1.2
busybox busybox 1.1.3
busybox busybox 1.11.1
busybox busybox 1.11.2
busybox busybox 1.13.1
busybox busybox 1.13.2
busybox busybox 1.14.4
busybox busybox 1.15.0
busybox busybox 1.17.0
busybox busybox 1.17.1
busybox busybox 1.18.4
busybox busybox 1.18.5
busybox busybox 1.2.2
busybox busybox 1.2.2.1
busybox busybox 1.4.0
busybox busybox 1.4.1
busybox busybox 1.7.2
busybox busybox 1.7.3
busybox busybox 0.41
busybox busybox 0.42
busybox busybox 0.50
busybox busybox 0.51
busybox busybox 1.00
busybox busybox 1.01
busybox busybox 1.10.2
busybox busybox 1.10.3
busybox busybox 1.12.1
busybox busybox 1.12.2
busybox busybox 1.14.0
busybox busybox 1.14.1
busybox busybox 1.15.3
busybox busybox 1.16.0
busybox busybox 1.17.4
busybox busybox 1.18.0
busybox busybox 1.19.3
busybox busybox 1.19.4
busybox busybox
busybox busybox 1.3.0
busybox busybox 1.5.1
busybox busybox 1.6.0
busybox busybox 1.6.1
busybox busybox 1.8.2
busybox busybox 1.9.0
busybox busybox 0.43
busybox busybox 0.45
busybox busybox 0.52
busybox busybox 0.60.0
busybox busybox 1.1.0
busybox busybox 1.1.1
busybox busybox 1.10.4
busybox busybox 1.11.0
busybox busybox 1.12.3
busybox busybox 1.12.4
busybox busybox 1.13.0
busybox busybox 1.14.2
busybox busybox 1.14.3
busybox busybox 1.16.1
busybox busybox 1.16.2
busybox busybox 1.18.1
busybox busybox 1.18.2
busybox busybox 1.18.3
busybox busybox 1.2.0
busybox busybox 1.2.1
busybox busybox 1.3.1
busybox busybox 1.3.2
busybox busybox 1.7.0
busybox busybox 1.7.1
busybox busybox 1.9.1
busybox busybox 1.9.2
busybox busybox 0.39
busybox busybox 0.40
busybox busybox 0.48
busybox busybox 0.49
busybox busybox 0.60.4
busybox busybox 0.60.5
busybox busybox 1.10.0
busybox busybox 1.10.1
busybox busybox 1.11.3
busybox busybox 1.12.0
busybox busybox 1.13.3
busybox busybox 1.13.4
busybox busybox 1.15.1
busybox busybox 1.15.2
busybox busybox 1.17.2
busybox busybox 1.17.3
busybox busybox 1.19.0
busybox busybox 1.19.2
busybox busybox 1.20.0
busybox busybox 1.20.1
busybox busybox 1.4.2
busybox busybox 1.5.0
busybox busybox 1.8.0
busybox busybox 1.8.1

Synopsis Low: busybox security and bug fix update Type/Severity Security Advisory: Low Topic Updated busybox packages that fix one security issue and several bugs arenow available for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as having lowsecurity impact A Common V ...

Debian Bug report logs - #701965 CVE-2013-1813 busybox mdev creates deep subdirs in /dev with 0777 permissions Package: busybox; Maintainer for busybox is Debian Install System Team <debian-boot@listsdebianorg>; Source for busybox is src:busybox (PTS, buildd, popcon) Reported by: Michael Tokarev <mjt@tlsmskru> Da ...

Phoenix Contact TC Router and TC Cloud Client versions 2053 and below, 20317 and below, and 10317 and below suffer from authenticated command injection and various other vulnerabilities ...

ZTE Mobile Hotspot MS910S version DL_MF910S_CN_EUV10001 suffers from having a hard-coded administrative password, busybox vulnerabilities, and having a known backdoor in the GoAhead webserver ...

The industrial managed switch series 852 from WAGO is affected by multiple vulnerabilities such as old software components embedded in the firmware Furthermore, hardcoded password hashes and credentials were also found by doing an automated scan with IoT Inspector ...

Full Disclosure mailing list archives   By Date By Thread </form>    SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series <!--X-Subject-Heade ...

Full Disclosure mailing list archives   By Date By Thread </form>    SEC Consult SA-20200827-0 :: Multiple Vulnerabilities in ZTE mobile Hotspot MS910S  <!--X-H ...

Full Disclosure mailing list archives   By Date By Thread </form>    SEC Consult SA-20200312-0 :: Authenticated Command Injection in Phoenix Contact TC Router & TC Cloud Client <!--X- ...

CWE-264 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701965 http://rhn.redhat.com/errata/RHSA-2013-1732.html http://git.busybox.net/busybox/commit/?id=4609f477c7e043a4f6147dfe6e86b775da2ef784 http://lists.busybox.net/pipermail/busybox/2013-January/078864.html https://support.t-mobile.com/docs/DOC-21994 http://seclists.org/fulldisclosure/2019/Jun/18 https://seclists.org/bugtraq/2019/Jun/14 http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html http://seclists.org/fulldisclosure/2020/Mar/15 http://seclists.org/fulldisclosure/2020/Aug/20 https://access.redhat.com/errata/RHSA-2013:1732 https://nvd.nist.gov

CVE-2013-1813

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Mailing Lists

References

Vulmon Search

About

Products

Connect