PT-2012-3956 · Node.Js · Node.Js

Alex Legler · Published 2012-08-13 · Updated 2023-02-13 · CVE-2012-2330

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Node.js versions prior to 0.6.17 Node.js versions prior to 0.7.8

Description The issue allows remote attackers to obtain sensitive information, such as request header contents, and possibly spoof HTTP headers via a zero-length string. This is due to the Update method in src/node http parser.cc not properly checking the length of a string.

Recommendations For Node.js versions prior to 0.6.17, update to version 0.6.17 or later. For Node.js versions prior to 0.7.8, update to version 0.7.8 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2012-2330

Affected Products

Node.Js

References · 11

• 🔥 https://github.com/joyent/node/commit/c9a231d · Exploit
• 🔥 https://github.com/joyent/node/commit/7b3fb22 · Exploit
• https://osv.dev/vulnerability/CVE-2012-2330 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-2330 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2330 · Security Note
• http://secunia.com/advisories/49066 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2330 · Vendor Advisory
• http://openwall.com/lists/oss-security/2012/05/08/4 · Note
• http://blog.nodejs.org/2012/05/04/version-0-6-17-stable · Note
• http://openwall.com/lists/oss-security/2012/05/08/8 · Note
• https://support.f5.com/csp/article/K99038439?utm_source=f5support&amp%3Butm_medium=RSS · Note