CVE-2018-20679

NameCVE-2018-20679
DescriptionAn issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs918846

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
busybox (PTS)stretch1:1.22.0-19vulnerable
stretch (security)1:1.22.0-19+deb9u2vulnerable
buster1:1.30.1-4fixed
bullseye1:1.30.1-6fixed
bookworm, sid1:1.30.1-7fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
busyboxsource(unstable)1:1.30.1-1low918846

Notes

[stretch] - busybox <no-dsa> (Minor issue)
[jessie] - busybox <no-dsa> (Minor issue)
https://bugs.busybox.net/show_bug.cgi?id=11506
https://git.busybox.net/busybox/commit/?id=6d3b4bb24da9a07c263f3c1acf8df85382ff562c
When fixing this issue make sure to not open CVE-2019-5747 by only
applying the partial fix. The followup commit
https://git.busybox.net/busybox/commit/?id=74d9f1ba37010face4bd1449df4d60dd84450b06
is needed to fix the issue completely.

Search for package or bug name: Reporting problems