CVE-2016-10615: Insecure Download of Executable in curses
Summary
CVE-2016-10615: Downloads Resources over HTTP in curses. Affects curses versions < 0.0.10. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curses package is an npm package that provides a set of functions for creating text-based user interfaces in the terminal. It is commonly used for creating command-line applications and games. The package has not been updated since 2013 and is affected by a vulnerability that allows insecure downloading of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in curses occurs when it insecurely downloads an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This can result in code execution on the system running curses. The risk of exploitation is higher when connected to a public network, but even on a private network, it can be exploited by those who have compromised the network or have privileged access to the ISP.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the only workaround is to avoid using the curses package and use an alternative package instead. If the package is already installed on a private network, ensure that it is not connected to a public network to reduce the risk of exploitation.
Conclusion
The curses package is affected by a vulnerability that allows insecure downloading of an executable over an unencrypted HTTP connection. As there is no patch available, the best course of action is to avoid using the package and look for alternative solutions. If the package is already installed on a private network, ensure that it is not connected to a public network to reduce the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for curses →
FAQ
The curses package is an npm package that provides functions for creating text-based user interfaces in the terminal.
The vulnerability allows an attacker to replace the downloaded executable with a malicious one, potentially leading to code execution on the system running curses.
No, there is currently no patch available for this vulnerability.
The curses package has not been updated since 2013.
To reduce the risk of exploitation, avoid using the curses package and ensure that it is not connected to a public network if already installed on a private network.
