PT-2018-4763 · Libxl · Libxl

Published 2018-06-01 · Updated 2019-10-09 · CVE-2016-10585

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libxl (affected versions not specified)

Description The issue concerns the insecure download of resources over HTTP, making it susceptible to man-in-the-middle (MITM) attacks. This could potentially lead to remote code execution (RCE) if an attacker intercepts and alters the downloaded zip file. The vulnerability exploits the lack of encryption in the HTTP connection, allowing an attacker with a privileged network position to replace the executable with a malicious one, resulting in code execution on the system running libxl.

Recommendations For all affected versions, consider installing the bindings using a pinned and verified version of the SDK instead of the automated download to mitigate the risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Improper Privilege Management

Weakness Enumeration

CWE-311

CWE-269

CWE-310

Related Identifiers

CVE-2016-10585

GHSA-7VRQ-VG6P-32FW

Affected Products

Libxl

References · 7

• https://osv.dev/vulnerability/GHSA-7vrq-vg6p-32fw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-10585 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10585 · Security Note
• https://github.com/DirtyHairy/node-libxl · Note
• https://npmjs.com/advisories/178 · Note
• https://nodesecurity.io/advisories/178 · Note
• https://github.com/advisories/GHSA-7vrq-vg6p-32fw · Note