In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.
En tar en BusyBox hasta 1.37.0, un archivo TAR puede tener nombres de archivo ocultos en una lista mediante el uso de secuencias de escape de terminal.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | LOW |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-451
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| busybox | busybox | * | <built-in method update of dict object at 0x7f760079c780> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:* |