CVE-2016-10607: Insecure Download of Executable in openframe-glslviewer
Summary
CVE-2016-10607: Downloads Resources over HTTP in openframe-glslviewer. Affects openframe-glslviewer versions < 0.2.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
openframe-glslviewer is an npm package that allows users to view GLSL shaders in an openframe environment. It provides a platform for rendering and manipulating shaders. However, versions of openframe-glslviewer prior to 0.2.8 are vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in openframe-glslviewer arises from the insecure download of an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This could lead to code execution on the system running openframe-glslviewer. The risk of exploitation is higher when connected to a public network, but even on a private network, attackers who have compromised the network or have privileged access to the ISP can exploit this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To mitigate the risk of exploitation, it is recommended to uninstall openframe-glslviewer if it is installed on a system connected to a public network. If the package is installed on a private network, ensure that the network is secure and access is limited to trusted individuals.
Conclusion
openframe-glslviewer versions prior to 0.2.8 are vulnerable to an insecure download of an executable over an unencrypted HTTP connection. No patch is available, and the package hasn't been updated since 2014. It is recommended to avoid using this package and opt for an alternative if possible. If you must use openframe-glslviewer, take precautions to reduce the risk of exploitation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for openframe-glslviewer →
FAQ
openframe-glslviewer is an npm package that allows users to view GLSL shaders in an openframe environment. It provides a platform for rendering and manipulating shaders.
The impact of this vulnerability is that an attacker can intercept the download of an executable and replace it with a malicious one. This could lead to code execution on the system running openframe-glslviewer.
No, there is currently no patch available for this vulnerability, and the package hasn't been updated since 2014.
It is recommended to avoid using openframe-glslviewer due to the vulnerability. If possible, use a different package for viewing GLSL shaders.
To reduce the risk of exploitation, ensure that openframe-glslviewer is not installed while connected to a public network. If it is installed on a private network, limit access to trusted individuals and ensure the network is secure.
