Company
Date Published
Author
Vera Mens, Uri Katz, Tal Keren, Sharon Brizinov from Claroty Research Shachar Menashe from JFrog
Word count
2744
Language
English
Hacker News points
None

Summary

BusyBox, a compact software suite for embedded Linux devices, was found to have 14 vulnerabilities by Claroty's Team82 and JFrog, affecting its latest version before 1.34.0. These vulnerabilities, primarily leading to denial of service (DoS), information leaks, and possible remote code execution, were uncovered through static and dynamic analysis, including fuzzing techniques. The vulnerabilities were privately disclosed and subsequently fixed in BusyBox version 1.34.0. BusyBox is widely used in operational technology (OT) and Internet of Things (IoT) devices, and the research findings were shared to support the open-source community in identifying and addressing further security issues. The vulnerabilities, cataloged with specific CVE IDs, could potentially be exploited if appropriate conditions are met, although they are not deemed to pose a critical security threat due to mitigation factors like applet operations typically running as separate processes. The research includes open-sourced fuzzing harnesses to aid further discovery of issues, emphasizing community collaboration in enhancing BusyBox's security.