PT-2022-11722 · Refirm+2 · Binwalk+2

Devttys0 · Published 2022-12-27 · Updated 2025-01-27 · CVE-2021-4287

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ReFirm Labs binwalk versions up to 2.3.2

Description A problematic issue was found in the Archive Extraction Handler component, specifically in the file src/binwalk/modules/extractor.py. The manipulation leads to symlink following, and it is possible to launch the attack remotely.

Recommendations For ReFirm Labs binwalk versions up to 2.3.2, upgrade to version 2.3.3 to address this issue.

Fix

Link Following

Weakness Enumeration

CWE-61

CWE-59

Related Identifiers

ALT-PU-2021-4837

ALT-PU-2024-8902

ALT-PU-2025-1936

CVE-2021-4287

GHSA-8M3F-G62J-3VX8

Affected Products

Alt Linux

Debian

Binwalk

References · 19

• https://github.com/ReFirmLabs/binwalk/commit/fa0c0bd59b8588814756942fe4cb5452e76c1dcd · Patch
• https://github.com/ReFirmLabs/binwalk/releases/tag/v2.3.3 · Patch
• https://github.com/ReFirmLabs/binwalk/pull/556 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-4287 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-4287 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-4287 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-4287 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-4287 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-4287 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8m3f-g62j-3vx8 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-4287 · Vendor Advisory
• https://github.com/ReFirmLabs/binwalk · Note
• https://vuldb.com/?ctiid.216876 · Note
• https://t.me/cvenotify/54559 · Telegram Post
• https://t.me/cvenotify/42274 · Telegram Post