Bug 1515713 – CVE-2017-16544 busybox: Insufficient sanitization of filenames when autocompleting

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1515713 - (CVE-2017-16544) CVE-2017-16544 busybox: Insufficient sanitization of filenames when autocompleting

Summary:	CVE-2017-16544 busybox: Insufficient sanitization of filenames when autocompl...

Status:	CLOSED WONTFIX

Aliases:	CVE-2017-16544

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20171108,repor...
Keywords:	Security

Depends On:	1515259
Blocks:	1515717
	Show dependency tree / graph

Reported:	2017-11-21 04:26 EST by Andrej Nemec
Modified:	2018-02-12 04:15 EST (History)
CC List:	5 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:	It was found that the tab auto-completion feature of BusyBox did not sanitize filenames, leading to execution of arbitrary escape sequences in the terminal emulator. Exploitation of this flaw by an attacker could potentially result in code execution, arbitrary file writes, or other attacks under highly specific circumstances dependent on the usage of a vulnerable terminal emulator by the user.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-12-26 05:27:15 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Andrej Nemec 2017-11-21 04:26:35 EST

In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks when combined with the usage of vulnerable / buggy terminal emulators.

Upstream patch:

https://git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e7d9c11e8

External References:

https://www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-vulnerability/

Comment 1 Andrej Nemec 2017-11-21 04:27:25 EST

Created busybox tracking bugs for this issue:

Affects: fedora-all [bug 1515259]

Note You need to log in before you can comment on or make changes to this bug.