Published: 12/03/2017 Updated: 03/04/2019

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 187

Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N

The add_probe function in modutils/modprobe.c in BusyBox prior to 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an "ifconfig /usbserial up" command or a "mount -t /snd_pcm none /" command.

Vulnerable Product	Search on Vulmon	Subscribe to Product
busybox busybox

Debian Bug report logs - #776186 busybox: CVE-2014-9645: modprobe wrongly accepts paths as module names Package: src:busybox; Maintainer for src:busybox is Debian Install System Team <debian-boot@listsdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 25 Jan 2015 07:06:01 UTC Severity: nor ...

Several security issues were fixed in BusyBox ...

The add_probe function in modutils/modprobec in BusyBox before 1230 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an "ifconfig /usbserial up" command or a "mount -t /snd_pcm none /" command ...

Phoenix Contact TC Router and TC Cloud Client versions 2053 and below, 20317 and below, and 10317 and below suffer from authenticated command injection and various other vulnerabilities ...

Full Disclosure mailing list archives   By Date By Thread </form>    SEC Consult SA-20200312-0 :: Authenticated Command Injection in Phoenix Contact TC Router & TC Cloud Client <!--X- ...

CWE-20 https://plus.google.com/+MathiasKrause/posts/PqFCo4bfrWu https://bugzilla.redhat.com/show_bug.cgi?id=1185707 https://bugs.busybox.net/show_bug.cgi?id=7652 http://openwall.com/lists/oss-security/2015/01/24/4 http://git.busybox.net/busybox/commit/?id=4e314faa0aecb66717418e9a47a4451aec59262b http://www.securityfocus.com/bid/72324 https://security.gentoo.org/glsa/201503-13 https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html https://usn.ubuntu.com/3935-1/http://seclists.org/fulldisclosure/2020/Mar/15 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776186 https://usn.ubuntu.com/3935-1/https://nvd.nist.gov

CVE-2014-9645

Vulnerability Summary

Vendor Advisories

Exploits

Mailing Lists

References

Vulmon Search

About

Products

Connect