PT-2012-3956 · Node.Js · Node.Js

Alex Legler · Publicado 2012-08-13 · Atualizado 2023-02-13 · CVE-2012-2330

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Node.js versions prior to 0.6.17 Node.js versions prior to 0.7.8

Description The issue allows remote attackers to obtain sensitive information, such as request header contents, and possibly spoof HTTP headers via a zero-length string. This is due to the Update method in src/node http parser.cc not properly checking the length of a string.

Recommendations For Node.js versions prior to 0.6.17, update to version 0.6.17 or later. For Node.js versions prior to 0.7.8, update to version 0.7.8 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2012-2330

Produtos afetados

Node.Js

Referências · 11

• 🔥 https://github.com/joyent/node/commit/c9a231d · Exploit
• 🔥 https://github.com/joyent/node/commit/7b3fb22 · Exploit
• http://openwall.com/lists/oss-security/2012/05/08/4 · Nota
• http://blog.nodejs.org/2012/05/04/version-0-6-17-stable · Nota
• http://openwall.com/lists/oss-security/2012/05/08/8 · Nota
• https://osv.dev/vulnerability/CVE-2012-2330 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2012-2330 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-2330 · Nota de Segurança
• http://secunia.com/advisories/49066 · Aviso do Fabricante
• https://support.f5.com/csp/article/K99038439?utm_source=f5support&amp%3Butm_medium=RSS · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2330 · Aviso do Fabricante