News for hackers. Stuff that matters.

A comment on CVE-2017-16544: A Busybox autocompletion vulnerability. Parent comment

Re:CVE-2017-16544: A Busybox autocompletion vulnerability by helper on Monday November 20, 2017 @12:30PM (#15741559)
The vulnerability is that you can play tricks on interactive users' output. In general people (besides nerds) aren't shelling into these devices so it really doesn't seem like that big of a deal.
[ Parent | on HN ]
Re:CVE-2017-16544: A Busybox autocompletion vulnerability by zaarn on Tuesday November 21, 2017 @02:52AM (#15746382)
I quite often shell into such devices. I think just playing tricks is a start and can easily escalate into something more serious.

Alpine also uses Busybox by default (IIRC) and people will use that definitely so it's definitely a problem.

Busybox is not only used in embedded devices.

[ Parent | on HN ]