PT-2018-4853 · Unknown · Libsbmlsim
Published
2018-06-04
·
Updated
2019-10-09
·
CVE-2016-10675
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libsbmlsim (affected versions not specified)
Description
The issue arises from libsbmlsim downloading binary resources over HTTP, making it susceptible to man-in-the-middle (MITM) attacks. This could potentially lead to remote code execution (RCE) if an attacker intercepts the request and replaces the resources with a malicious version. The vulnerability can be exploited by an attacker with a privileged network position, allowing them to intercept and alter the response, resulting in code execution on the system running libsbmlsim.
Recommendations
To mitigate this issue, consider avoiding the use of this package until a secure version is available.
As a temporary workaround, avoid installing this package while connected to a public network to reduce the risk of exploitation.
If the package must be installed, ensure it is done on a private network, minimizing the risk of exploitation to only those with compromised network access or privileged ISP access.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Missing Encryption of Sensitive Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Libsbmlsim