CVE-2019-5747
Summary
| CVE | CVE-2019-5747 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2019-01-09 16:29:00 UTC |
|---|
| Updated | 2022-10-29 02:30:00 UTC |
|---|
| Description | An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Full Disclosure: SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X |
FULLDISC |
seclists.org |
|
| Cisco Device Hardcoded Credentials / GNU glibc / BusyBox ≈ Packet Storm |
MISC |
packetstormsecurity.com |
|
| USN-3935-1: BusyBox vulnerabilities | Ubuntu security notices | Ubuntu |
UBUNTU |
usn.ubuntu.com |
Third Party Advisory |
| Bugtraq: SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X |
BUGTRAQ |
seclists.org |
|
| busybox - BusyBox: The Swiss Army Knife of Embedded Linux |
MISC |
git.busybox.net |
Patch, Third Party Advisory |
| 11506 – Out of bounds read in udhcp_get_option() |
MISC |
bugs.busybox.net |
Exploit, Issue Tracking, Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 500080 Alpine Linux Security Update for busybox
- 503756 Alpine Linux Security Update for busybox
- 751624 SUSE Enterprise Linux Security Update for busybox (SUSE-SU-2022:0135-1)
- 751633 OpenSUSE Security Update for busybox (openSUSE-SU-2022:0135-1)
- 752794 SUSE Enterprise Linux Security Update for busybox (SUSE-SU-2022:3959-1)
- 752903 SUSE Enterprise Linux Security Update for busybox (SUSE-SU-2022:4253-1)
