PT-2018-4763 · Libxl · Libxl

Publicado 2018-06-01 · Atualizado 2019-10-09 · CVE-2016-10585

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libxl (affected versions not specified)

Description The issue concerns the insecure download of resources over HTTP, making it susceptible to man-in-the-middle (MITM) attacks. This could potentially lead to remote code execution (RCE) if an attacker intercepts and alters the downloaded zip file. The vulnerability exploits the lack of encryption in the HTTP connection, allowing an attacker with a privileged network position to replace the executable with a malicious one, resulting in code execution on the system running libxl.

Recommendations For all affected versions, consider installing the bindings using a pinned and verified version of the SDK instead of the automated download to mitigate the risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Improper Privilege Management

Enumeração de Fraquezas

CWE-311

CWE-269

CWE-310

Identificadores relacionados

CVE-2016-10585

GHSA-7VRQ-VG6P-32FW

Produtos afetados

Libxl

Referências · 7

• https://github.com/DirtyHairy/node-libxl · Nota
• https://osv.dev/vulnerability/GHSA-7vrq-vg6p-32fw · Aviso do Fabricante
• https://npmjs.com/advisories/178 · Nota
• https://osv.dev/vulnerability/CVE-2016-10585 · Aviso do Fabricante
• https://nodesecurity.io/advisories/178 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-10585 · Nota de Segurança
• https://github.com/advisories/GHSA-7vrq-vg6p-32fw · Nota