PT-2016-7216 · Node.Js+3 · Node.Js+3

Alexander Minozhenko

+1

·

Publicado

2016-10-05

·

Atualizado

2021-03-15

·

CVE-2016-7099

CVSS v3.1

5.9

Média

VetorAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Node.js versions 0.10.x through 0.10.46 Node.js versions 0.12.x through 0.12.15 Node.js versions 4.x through 4.5.0 Node.js versions 6.x through 6.6.0
Description The issue arises from the tls.checkServerIdentity function not properly handling wildcards in name fields of X.509 certificates. This allows man-in-the-middle attackers to spoof servers via a crafted certificate.
Recommendations For Node.js versions 0.10.x through 0.10.46, update to version 0.10.47 or later. For Node.js versions 0.12.x through 0.12.15, update to version 0.12.16 or later. For Node.js versions 4.x through 4.5.0, update to version 4.6.0 or later. For Node.js versions 6.x through 6.6.0, update to version 6.7.0 or later.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-19

Identificadores relacionados

ALT-PU-2016-2068
CVE-2016-7099
MGASA-2017-0204
OPENSUSE-SU-2016_2496-1
OPENSUSE-SU-2024:10247-1
RHSA-2017:0002
SUSE-SU-2016:2470-1
SUSE-SU-2016:2470-2
SUSE-SU-2019:14246-1
SUSE-SU-2019_14246-1
USN-4796-1

Produtos afetados

Alt Linux
Node.Js
Suse
Ubuntu