Heap-Based Buffer Overflow in BusyBox DHCP Client
CVE-2016-2148

9.8CRITICAL

Key Information:

Vendor

Busybox

Status
Busybox
Vendor
CVE Published:
9 February 2017

What is CVE-2016-2148?

A vulnerability exists in the DHCP client (udhcpc) within BusyBox prior to version 1.25.0, where a heap-based buffer overflow can occur. This can be exploited by remote attackers through specially crafted OPTION_6RD packets. The exploitation may lead to potential impacts that compromise the confidentiality, integrity, or availability of the affected systems. Proper versioning and updates are crucial to mitigate the risks associated with this vulnerability.

References

https://git.busybox.net/busybox/commit/?id=352f79acbd759c...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/03/11/16
mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/201612-04
vendor-advisoryx_refsource_GENTOO

EPSS Score

27% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.