CVE-2018-20679

NameCVE-2018-20679
DescriptionAn issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
Debian Bugs918846

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
busybox (PTS)jessie1:1.22.0-9+deb8u1vulnerable
jessie (security)1:1.22.0-9+deb8u4vulnerable
stretch1:1.22.0-19vulnerable
buster, sid1:1.27.2-3vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
busyboxsource(unstable)(unfixed)low918846

Notes

[stretch] - busybox <no-dsa> (Minor issue)
[jessie] - busybox <no-dsa> (Minor issue)
https://bugs.busybox.net/show_bug.cgi?id=11506
https://git.busybox.net/busybox/commit/?id=6d3b4bb24da9a07c263f3c1acf8df85382ff562c
When fixing this issue make sure to not open CVE-2019-5747 by only
applying the partial fix. The followup commit
https://git.busybox.net/busybox/commit/?id=74d9f1ba37010face4bd1449df4d60dd84450b06
is needed to fix the issue completely.

Search for package or bug name: Reporting problems