Vulnerabilidad · Publicado 14/10/2026
Se identificó un fallo en el manejador de archivos ar de BusyBox que procesa incorrectamente archivos .deb con miembros data.tar duplicados. Un atacante puede crear un archivo .deb malformado que explote el orden de descompresión de enlaces simbólicos para apuntar a rutas absolutas, comprometiendo sistemas Linux que utilizan BusyBox en entornos embebidos, contenedores y dispositivos IoT comunes en infraestructuras latinoamericanas. El CVSS 7.8 refleja impacto alto en disponibilidad e integridad del sistema.
A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package.
Score: 7.8/10 — Severidad: HIGH — Estado NIST: Received
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-59
Publicado en NIST NVD.