Busybox wget vulnerability

BusyBox project has fixed a vulnerability in BusyBox wget that may allow an attacker to execute arbitrary commands in the target system.

BusyBox combines tiny versions of many common UNIX utilities into a single small executable. It is generally used in embedded operating systems with limited resources.

Vulnerability coordination:

The vulnerability was found by Antti Levomäki, Christian Jalio, and Joonas Pihlaja from Forcepoint. NCSC-FI would like to thank Forcepoint and the BusyBox project for participating in the coordination.

Target of vulnerability

BusyBox versions prior to 1.29.0

What is this about?

Update BusyBox to the latest version.

What can I do?

Embedded systems

An embedded system consists of a device and its software. Relatively many of the devices used by consumers can be considered as embedded systems. An example of such systems is a digital set-top box which is necessary for viewing digital TV broadcasts.

Servers and server applications

Vulnerabilities in servers and server software concern providers of electronic services, among others. Typical targets are operating systems of servers, as well as web or e-mail server software, such as SunOS, Linux, Apache, IIS or Sendmail.

Remote

A remotely performed attack can be implemented via an information network connection or similar without accessing the targeted system.

Denial-of-service attack

The purpose of a denial-of-service attack is to prevent the target system from functioning in the task for which it is intended. The purpose of an attack can be, for example, overloading a web server or e-mail server with high volumes of network traffic.

Execution of arbitrary commands

A vulnerability that enables the execution of arbitrary commands must be considered serious because it means that the person utilising the vulnerability can use the targeted system just like an ordinary user of the system. It can also lead to that the attacker who has hacked into the system can via a network upload and execute own software in the system.

Software update patch

Normally, hardware or software manufacturers publish a new version or a partial update for a software or operating system soon after the vulnerability has become public. The update can be available at the same time as the vulnerability is published, but often the users have to wait for the update.