Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file".
References
Link | Resource |
---|---|
http://lists.busybox.net/pipermail/busybox/2018-May/086462.html | Mailing List Vendor Advisory |
https://git.busybox.net/busybox/commit/?id=45fa3f18adf57ef9d743038743d9c90573aeeb91 | Patch Vendor Advisory |
https://usn.ubuntu.com/4531-1/ | |
http://lists.busybox.net/pipermail/busybox/2018-May/086462.html | Mailing List Vendor Advisory |
https://git.busybox.net/busybox/commit/?id=45fa3f18adf57ef9d743038743d9c90573aeeb91 | Patch Vendor Advisory |
https://usn.ubuntu.com/4531-1/ |
Configurations
History
21 Nov 2024, 03:40
Type | Values Removed | Values Added |
---|---|---|
References | () http://lists.busybox.net/pipermail/busybox/2018-May/086462.html - Mailing List, Vendor Advisory | |
References | () https://git.busybox.net/busybox/commit/?id=45fa3f18adf57ef9d743038743d9c90573aeeb91 - Patch, Vendor Advisory | |
References | () https://usn.ubuntu.com/4531-1/ - |
Information
Published : 2018-06-26 16:29
Updated : 2024-11-21 03:40
NVD link : CVE-2018-1000500
Mitre link : CVE-2018-1000500
CVE.ORG link : CVE-2018-1000500
JSON object : View
Products Affected
busybox
- busybox
CWE
CWE-295
Improper Certificate Validation