PT-2013-5022 · Node.Js+1 · Node.Js+1

Marek Majkowski · Publicado 2013-10-21 · Atualizado 2018-08-13 · CVE-2013-4450

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Node.js versions 0.8.x through 0.8.25 Node.js versions 0.10.x through 0.10.20

Description The issue allows remote attackers to cause a denial of service by sending a large number of pipelined requests without reading the response, leading to memory and CPU consumption.

Recommendations For Node.js versions 0.8.x through 0.8.25, update to version 0.8.26 or later. For Node.js versions 0.10.x through 0.10.20, update to version 0.10.21 or later.

Exploit

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2016-1086

CVE-2013-4450

MGASA-2014-0007

RHSA-2013:1842

Produtos afetados

Alt Linux

Node.Js

Referências · 76

• 🔥 https://github.com/rapid7/metasploit-framework/pull/2548 · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/nodejs_pipelining.rb · Exploit
• 🔥 https://github.com/ssllabs/openssl-ccs-cve-2014-0224 · Exploit
• 🔥 https://github.com/secretnonempty/CVE-2014-0224 · Exploit
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/openssl_ccs.rb · Nota
• https://github.com/joyent/node/commit/530af9cb8e700e7596b3ec812bad123c9fa06356 · Nota
• https://github.com/joyent/node/commit/085dd30e93da67362f044ad1b3b6b2d997064692 · Nota
• https://github.com/joyent/node/issues/6214 · Nota
• https://github.com/Tripwire/OpenSSL-CCS-Inject-Test · Nota
• http://securityfocus.com/bid/63229 · Nota
• https://ubuntu.com/security/CVE-2013-4450 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-05846 · Nota de Segurança
• https://rhn.redhat.com/errata/RHSA-2013-1842.html · Nota
• https://bdu.fstec.ru/vul/2015-05851 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-07483 · Nota de Segurança