PT-2018-4853 · Unknown · Libsbmlsim
Publicado
2018-06-04
·
Atualizado
2019-10-09
·
CVE-2016-10675
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libsbmlsim (affected versions not specified)
Description
The issue arises from libsbmlsim downloading binary resources over HTTP, making it susceptible to man-in-the-middle (MITM) attacks. This could potentially lead to remote code execution (RCE) if an attacker intercepts the request and replaces the resources with a malicious version. The vulnerability can be exploited by an attacker with a privileged network position, allowing them to intercept and alter the response, resulting in code execution on the system running libsbmlsim.
Recommendations
To mitigate this issue, consider avoiding the use of this package until a secure version is available.
As a temporary workaround, avoid installing this package while connected to a public network to reduce the risk of exploitation.
If the package must be installed, ensure it is done on a private network, minimizing the risk of exploitation to only those with compromised network access or privileged ISP access.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Missing Encryption of Sensitive Data
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Libsbmlsim