CVE-2021-4287 (CNNVD-202212-3955)
中文标题:
ReFirm Labs Binwalk 后置链接漏洞
英文标题:
ReFirm Labs binwalk Archive Extraction extractor.py symlink
漏洞描述
中文描述:
Binwalk是ReFirm Labs开源的一种快速、易于使用的工具。用于分析、逆向工程和提取固件图像。 ReFirm Labs Binwalk 2.3.2之前版本存在安全漏洞，该漏洞源于组件 Archive Extraction Handler 的文件 src/binwalk/modules/extractor.py 的一个未知函数，操作导致符号链接跟随。
英文描述:
A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unknown function of the file src/binwalk/modules/extractor.py of the component Archive Extraction Handler. The manipulation leads to symlink following. It is possible to launch the attack remotely. Upgrading to version 2.3.3 is able to address this issue. The name of the patch is fa0c0bd59b8588814756942fe4cb5452e76c1dcd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216876.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| ReFirm Labs | binwalk | 2.3.0 | - | - |
cpe:2.3:a:refirm_labs:binwalk:2.3.0:*:*:*:*:*:*:*
|
| ReFirm Labs | binwalk | 2.3.1 | - | - |
cpe:2.3:a:refirm_labs:binwalk:2.3.1:*:*:*:*:*:*:*
|
| ReFirm Labs | binwalk | 2.3.2 | - | - |
cpe:2.3:a:refirm_labs:binwalk:2.3.2:*:*:*:*:*:*:*
|
| microsoft | binwalk | * | - | - |
cpe:2.3:a:microsoft:binwalk:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (cna)
MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
3.0 (cna)
MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2021-4287 |
2025-11-11 15:21:12 | 2025-11-11 07:37:04 |
| NVD | nvd_CVE-2021-4287 |
2025-11-11 14:57:51 | 2025-11-11 07:45:22 |
| CNNVD | cnnvd_CNNVD-202212-3955 |
2025-11-11 15:11:05 | 2025-11-11 07:57:43 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 后置链接
- cnnvd_id: 未提取 -> CNNVD-202212-3955
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 3 -> 4
- data_sources: ['cve'] -> ['cve', 'nvd']