I reported this one in busybox's netstat a year ago: https://bugs.busybox.net/show_bug.cgi?id=15922
The whole code needs a security audit for ANSI escapes like this. Best, R On 4/23/25 4:11 PM, Ian Norton wrote:
https://bugs.busybox.net/show_bug.cgi?id=16018 (awaiting CVE) Busybox's cpio and tar tools will print un-escaped filenames when listing and unpacking cpio and tar files. Malicious files containing filenames with terminal escapes can be used to mask or modify earlier or later files in the archive from anyone running busybox tar or cpio from a terminal. see also https://lists.busybox.net/pipermail/busybox/2024-July/090806.html https://security-tracker.debian.org/tracker/CVE-2023-39810 A unpacking a cpio archive can escape the working directory. Due to #16018 it is possible to mask these traversals from anyone using cpio to inspect a file before unpacking. see also https://lists.busybox.net/pipermail/busybox/2024-July/090851.html Any email and files/attachments transmitted with it are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.
