CVE:CVE-2013-1813
CNNVD:CNNVD-201303-009
BusyBox是乌克兰软件开发者Denis Vlasenko所负责维护的一套包含了多个linux命令和工具的应用程序。
BusyBox 1.20.2及之前的版本中的util-linux/mdev.c文件中存在安全漏洞，当在/dev/下创建目录时使用全局可写权限。本地攻击者可利用该漏洞提升权限。
solution:Upgrade redhat enterprise_linux to a higher version than 6.0,and avoid the version 6.0; Upgrade t-mobile tm-ac1900 to a higher version than 3.0.0.4.376_3169,and avoid the version 3.0.0.4.376_3169; Upgrade busybox busybox to a higher version than 1.20.2,0.38,0.39,0.40,0.41,0.42,0.43,0.45,0.46,0.47,0.48,0.49,0.50,0.51,0.52,0.60.0,0.60.1,0.60.2,0.60.3,0.60.4,0.60.5,1.00,1.01,1.1.0,1.1.1,1.1.2,1.1.3,1.2.0,1.2.1,1.2.2,1.2.2.1,1.3.0,1.3.1,1.3.2,1.4.0,1.4.1,1.4.2,1.5.0,1.5.1,1.6.0,1.6.1,1.7.0,1.7.1,1.7.2,1.7.3,1.8.0,1.8.1,1.8.2,1.9.0,1.9.1,1.9.2,1.10.0,1.10.1,1.10.2,1.10.3,1.10.4,1.11.0,1.11.1,1.11.2,1.11.3,1.12.0,1.12.1,1.12.2,1.12.3,1.12.4,1.13.0,1.13.1,1.13.2,1.13.3,1.13.4,1.14.0,1.14.1,1.14.2,1.14.3,1.14.4,1.15.0,1.15.1,1.15.2,1.15.3,1.16.0,1.16.1,1.16.2,1.17.0,1.17.1,1.17.2,1.17.3,1.17.4,1.18.0,1.18.1,1.18.2,1.18.3,1.18.4,1.18.5,1.19.0,1.19.2,1.19.3,1.19.4,1.20.0,1.20.1,and avoid the version (,1.20.2],0.38,0.39,0.40,0.41,0.42,0.43,0.45,0.46,0.47,0.48,0.49,0.50,0.51,0.52,0.60.0,0.60.1,0.60.2,0.60.3,0.60.4,0.60.5,1.00,1.01,1.1.0,1.1.1,1.1.2,1.1.3,1.2.0,1.2.1,1.2.2,1.2.2.1,1.3.0,1.3.1,1.3.2,1.4.0,1.4.1,1.4.2,1.5.0,1.5.1,1.6.0,1.6.1,1.7.0,1.7.1,1.7.2,1.7.3,1.8.0,1.8.1,1.8.2,1.9.0,1.9.1,1.9.2,1.10.0,1.10.1,1.10.2,1.10.3,1.10.4,1.11.0,1.11.1,1.11.2,1.11.3,1.12.0,1.12.1,1.12.2,1.12.3,1.12.4,1.13.0,1.13.1,1.13.2,1.13.3,1.13.4,1.14.0,1.14.1,1.14.2,1.14.3,1.14.4,1.15.0,1.15.1,1.15.2,1.15.3,1.16.0,1.16.1,1.16.2,1.17.0,1.17.1,1.17.2,1.17.3,1.17.4,1.18.0,1.18.1,1.18.2,1.18.3,1.18.4,1.18.5,1.19.0,1.19.2,1.19.3,1.19.4,1.20.0,1.20.1