PT-2018-4820 · Kitware · Cmake
Publicado
2018-06-04
·
Atualizado
2019-10-09
·
CVE-2016-10642
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
cmake (affected versions not specified)
Description
The issue concerns the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle (MITM) attacks. This could potentially lead to remote code execution (RCE) if an attacker intercepts the connection and swaps the requested binary with a malicious one. The vulnerability can be exploited if the attacker has a privileged network position.
Recommendations
To mitigate the issue, consider avoiding the use of this package if possible, or use a different package as an alternative.
Install the cmake binaries via a system package manager, such as
apt-get, to reduce the risk of exploitation.
As a temporary measure, avoid installing the package while connected to a public network to minimize the risk of exploitation.Correção
Missing Encryption of Sensitive Data
Improper Privilege Management
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Cmake