Buffer overflow in Busybox

CVE-2018-1000517

BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.

Vulnerability class: Buffer Overflow

EPSS: 0.329 (98.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

  • cve@mitre.org (Patch, x_refsource_MISC, Vendor Advisory)
  • cve@mitre.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
  • cve@mitre.org (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
  • cve@mitre.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2018-1000517?
CVE-2018-1000517 is a critical-severity vulnerability in Busybox, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 9.8/10. Published 2018-06-26.
How severe is CVE-2018-1000517?
Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2018-1000517 known to be exploited?
2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.