CVE-2016-10603: Insecure Download of Executable in air-sdk
Summary
CVE-2016-10603: Downloads Resources over HTTP in air-sdk. Affects air-sdk versions < 16.0.0-272-9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The air-sdk is an npm package that provides a software development kit for creating Adobe AIR applications. It offers a range of tools and resources to facilitate the development process. However, versions of air-sdk prior to 16.0.0-272-9 are vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in air-sdk arises from the insecure download of an executable file. When the package is installed and connected to a network, an attacker with a privileged network position can intercept the response and replace the downloaded executable with a malicious one. This can lead to code execution on the system running air-sdk. The risk of exploitation is higher when connected to a public network, but even on a private network, attackers who have compromised the network or have privileged access to the ISP can exploit this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the recommended workaround is to avoid using the air-sdk package and opt for an alternative package that provides similar functionality. By doing so, you can mitigate the risk of exploitation associated with this vulnerability.
Conclusion
The air-sdk package is vulnerable to an insecure download of an executable, which can lead to code execution on the system. As no patch is available, it is recommended to avoid using this package and consider alternative options. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for air-sdk →
FAQ
air-sdk is an npm package that provides a software development kit for creating Adobe AIR applications. It offers various tools and resources to aid in the development process.
The vulnerability allows an attacker with a privileged network position to replace the downloaded executable with a malicious one, potentially leading to code execution on the system running air-sdk.
No, there is currently no patch available for this vulnerability, and the package has not been updated since 2015.
To mitigate the risk, it is recommended to avoid using the air-sdk package and consider using an alternative package if possible. Additionally, ensure that the package is not installed while connected to a public network.
The vulnerability can be exploited by attackers who have a privileged network position, such as those who have compromised the network or have privileged access to the ISP.
