{"vulnerability": "CVE-2022-28391", "sightings": [{"uuid": "0282976b-f6aa-4a52-8f5e-cf3a0864b511", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-28391", "type": "seen", "source": "https://t.me/ShizoPrivacy/256", "content": "|CVE-2022-28391|\nBusyBox code execution\nCVSS score: 9.8\n\n\ud83e\udda0\u0412 \u0432\u0435\u0440\u0441\u0438\u0438 1.35.0 BusyBox \u0431\u044b\u043b\u0430 \u043d\u0430\u0439\u0434\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434,\u0435\u0441\u043b\u0438 netstat \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0432\u044b\u0432\u043e\u0434\u0430 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 PTR DNS \u043d\u0430 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b, \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u044b\u0439 \u0441 VT. \u0414\u043b\u044f \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e, PTR \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0445\u043e\u0441\u0442\u0430 \u0434\u043e\u043b\u0436\u0435\u043d \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442\u044c escape sequence \u0438 \u0436\u0435\u0440\u0442\u0432\u0430 \u0434\u043e\u043b\u0436\u043d\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c netstat.\n\u0422\u0430\u043a\u0436\u0435, \u043a\u0430\u043a \u043f\u0438\u0448\u0443\u0442 \u0432 \u0432\u0435\u0442\u043a\u0435 \u043f\u0440\u043e \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, nslookup \u0442\u043e\u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c.\n\u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u044d\u0442\u0430 CVE \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043d\u0430 AlpineLinux.\n\n\ud83e\udda0In version 1.35.0  BusyBox has found a vulnerability that allows an attacker to execute arbitrary code if netstat is used to output the values of a DNS PTR record to a VT-compatible terminal. In order to exploit the vulnerability, the PTR for the remote host must contain an escape sequence and the victim must execute netstat.\nAlso, as they write in the branch  about this vulnerability, nslookup is also vulnerable.\nInitially, this CVE was discovered on AlpineLinux.\n\n#cve", "creation_timestamp": "2022-04-06T17:46:53.000000Z"}]}