CVE-2018-20679
busybox: An issue was discovered in BusyBox before 1.30.0
CVE-2018-20679 is fixed in 6 products on 1 platform, first by busybox 1:1.27.2-2ubuntu3.2, released January 8, 2019. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0769
94th percentile
An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| busybox · Ubuntu 18.04.6 LTS (bionic) | 1:1.27.2-2ubuntu3.2 | busybox 1:1.27.2-2ubuntu3.2 | Jan 8, 2019 |
| busybox-initramfs · Ubuntu 18.04.6 LTS (bionic) | 1:1.27.2-2ubuntu3.2 | busybox-initramfs 1:1.27.2-2ubuntu3.2 | Jan 8, 2019 |
| busybox-static · Ubuntu 18.04.6 LTS (bionic) | 1:1.27.2-2ubuntu3.2 | busybox-static 1:1.27.2-2ubuntu3.2 | Jan 8, 2019 |
| busybox-syslogd · Ubuntu 18.04.6 LTS (bionic) | 1:1.27.2-2ubuntu3.2 | busybox-syslogd 1:1.27.2-2ubuntu3.2 | Jan 8, 2019 |
| udhcpc · Ubuntu 18.04.6 LTS (bionic) | 1:1.27.2-2ubuntu3.2 | udhcpc 1:1.27.2-2ubuntu3.2 | Jan 8, 2019 |
| udhcpd · Ubuntu 18.04.6 LTS (bionic) | 1:1.27.2-2ubuntu3.2 | udhcpd 1:1.27.2-2ubuntu3.2 | Jan 8, 2019 |