CVE-2011-5325

Опубликовано: 07 авг. 2017

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.

Ссылки

http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2019/Jun/18
Exploit
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2020/Aug/20
Exploit
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/10/21/7
Mailing List
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1274215
Issue Tracking
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2019/Jun/14
Exploit
Mailing List
Third Party Advisory
https://usn.ubuntu.com/3935-1/
Third Party Advisory
http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2019/Jun/18
Exploit
Mailing List
Third Party Advisory
http://seclists.org/fulldisclosure/2020/Aug/20
Exploit
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/10/21/7
Mailing List
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1274215
Issue Tracking
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2019/Jun/14
Exploit
Mailing List
Third Party Advisory
https://usn.ubuntu.com/3935-1/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*

Версия до 1.21.1 (включая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

EPSS

Процентиль: 89%

0.0466

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

CVE-2011-5325

CVSS3: 7.5

ubuntu

около 8 лет назад

Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.

CVE-2011-5325

redhat

почти 10 лет назад

Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.

CVE-2011-5325

CVSS3: 7.5

debian

около 8 лет назад

Directory traversal vulnerability in the BusyBox implementation of tar ...

GHSA-28cm-w7c9-p27f

CVSS3: 7.5

github

больше 3 лет назад

Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.

BDU:2021-03339

CVSS3: 7.5

fstec

больше 14 лет назад

Уязвимость набора UNIX-утилит командной строки BusyBox, связанная с некорректным ограничением имени пути к каталогу, позволяющая нарушителю оказать воздействие на целостность данных

EPSS

Процентиль: 89%

0.0466

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22