CVEvulnerability
CVE-2013-1813
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2013-11-23
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-264
Description
util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors.
Affected configurations
• redhat enterprise linux 6.0
• t-mobile tm-ac1900 3.0.0.4.376 3169
• busybox busybox (<= 1.20.2)
• busybox busybox 0.38
• busybox busybox 0.39
• busybox busybox 0.40
• busybox busybox 0.41
• busybox busybox 0.42
• busybox busybox 0.43
• busybox busybox 0.45
• busybox busybox 0.46
• busybox busybox 0.47
• busybox busybox 0.48
• busybox busybox 0.49
• busybox busybox 0.50
• busybox busybox 0.51
• busybox busybox 0.52
• busybox busybox 0.60.0
• busybox busybox 0.60.1
• busybox busybox 0.60.2
• busybox busybox 0.60.3
• busybox busybox 0.60.4
• busybox busybox 0.60.5
• busybox busybox 1.00
• busybox busybox 1.01
• busybox busybox 1.1.0
• busybox busybox 1.1.1
• busybox busybox 1.1.2
• busybox busybox 1.1.3
• busybox busybox 1.2.0
• busybox busybox 1.2.1
• busybox busybox 1.2.2
• busybox busybox 1.2.2.1
• busybox busybox 1.3.0
• busybox busybox 1.3.1
• busybox busybox 1.3.2
• busybox busybox 1.4.0
• busybox busybox 1.4.1
• busybox busybox 1.4.2
• busybox busybox 1.5.0
• busybox busybox 1.5.1
• busybox busybox 1.6.0
• busybox busybox 1.6.1
• busybox busybox 1.7.0
• busybox busybox 1.7.1
• busybox busybox 1.7.2
• busybox busybox 1.7.3
• busybox busybox 1.8.0
• busybox busybox 1.8.1
• busybox busybox 1.8.2
• busybox busybox 1.9.0
• busybox busybox 1.9.1
• busybox busybox 1.9.2
• busybox busybox 1.10.0
• busybox busybox 1.10.1
• busybox busybox 1.10.2
• busybox busybox 1.10.3
• busybox busybox 1.10.4
• busybox busybox 1.11.0
• busybox busybox 1.11.1
… and 41 more
Related
Weakness · not in database (1)
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701965 bugs.debian.org
- http://git.busybox.net/busybox/commit/?id=4609f477c7e043a4f6147dfe6e86b775da2ef784 Exploit, Patch
- http://lists.busybox.net/pipermail/busybox/2013-January/078864.html lists.busybox.net
- http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html packetstormsecurity.com
- http://rhn.redhat.com/errata/RHSA-2013-1732.html Vendor Advisory
- http://seclists.org/fulldisclosure/2019/Jun/18 seclists.org
- http://seclists.org/fulldisclosure/2020/Aug/20 seclists.org
- http://seclists.org/fulldisclosure/2020/Mar/15 seclists.org
- https://seclists.org/bugtraq/2019/Jun/14 seclists.org
- https://support.t-mobile.com/docs/DOC-21994 support.t-mobile.com
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701965 bugs.debian.org
- http://git.busybox.net/busybox/commit/?id=4609f477c7e043a4f6147dfe6e86b775da2ef784 Exploit, Patch
- http://lists.busybox.net/pipermail/busybox/2013-January/078864.html lists.busybox.net
- http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html packetstormsecurity.com
- http://rhn.redhat.com/errata/RHSA-2013-1732.html Vendor Advisory
- http://seclists.org/fulldisclosure/2019/Jun/18 seclists.org
- http://seclists.org/fulldisclosure/2020/Aug/20 seclists.org
- http://seclists.org/fulldisclosure/2020/Mar/15 seclists.org
- https://seclists.org/bugtraq/2019/Jun/14 seclists.org
- https://support.t-mobile.com/docs/DOC-21994 support.t-mobile.com