PT-2016-4589 · Rust · Portaudio

Published 2016-08-01 · Updated 2021-08-25 · CVE-2016-10933

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions portaudio crate versions prior to 0.7.1

Description The issue concerns a man-in-the-middle problem due to the use of cleartext HTTP for downloading the source code. This allows an attacker to intercept the download and potentially achieve remote code execution (RCE) by replacing the original source code with a malicious archive.

Recommendations For portaudio crate versions prior to 0.7.1, update to version 0.7.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the build script that downloads the portaudio source over HTTP until a secure version is available. Avoid using the build script in untrusted networks to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

CWE-254

Related Identifiers

CVE-2016-10933

GHSA-PQ6V-X7GP-7776

RUSTSEC-2016-0003

Affected Products

Portaudio

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2016-10933 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2016-0003 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-10933 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pq6v-x7gp-7776 · Vendor Advisory
• https://github.com/RustAudio/rust-portaudio · Note
• https://github.com/RustAudio/rust-portaudio/issues/144 · Note
• https://rustsec.org/advisories/RUSTSEC-2016-0003.html · Note
• https://crates.io/crates/portaudio · Note