CVE-2016-10642: Insecure Download of Resources in CMake
Summary
CVE-2016-10642: Downloads Resources over HTTP in cmake. Affects cmake versions < 0.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CMake is a popular build system generator that allows developers to manage the build process of software projects. It is widely used across different platforms and ecosystems, including npm. CMake simplifies the process of configuring, building, and installing software by generating platform-specific build files. However, certain versions of CMake are vulnerable to an insecure download of resources over HTTP, which can lead to code execution on the system running CMake.
Vulnerability Detail
The affected versions of CMake insecurely download an executable over an unencrypted HTTP connection. This vulnerability can be exploited by an attacker who has a privileged network position. They can intercept the response and replace the executable with a malicious one, potentially resulting in code execution on the system running CMake. This vulnerability poses a significant risk, especially in scenarios where the package is installed on a public network or when an attacker has compromised the network or has privileged access to the ISP.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the recommended workaround is to avoid using the affected package and use an alternative package or installation method. If you must use CMake, consider installing the CMake binaries via a system package manager, such as apt-get, to ensure a secure installation. It is also advisable to avoid installing the package while connected to a public network.
Conclusion
The vulnerability in CMake that allows insecure download of resources over HTTP poses a significant risk of code execution on the system running CMake. To mitigate this risk, it is recommended to avoid using the affected package and consider alternative packages or installation methods. If you need to use CMake, install the CMake binaries via a system package manager and avoid installing the package while connected to a public network. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cmake →
FAQ
CMake is a build system generator that simplifies the process of configuring, building, and installing software projects. It is widely used across different platforms and ecosystems.
The vulnerability allows an attacker with a privileged network position to intercept and replace the downloaded executable, potentially leading to code execution on the system running CMake.
No, there is currently no patch available for this vulnerability.
To mitigate the risk, it is recommended to avoid using the affected package and consider using an alternative package or installation method. If you need to use CMake, install the CMake binaries via a system package manager, such as apt-get, and avoid installing the package while connected to a public network.
While it is not recommended to use the affected package, if you must use CMake, consider installing the CMake binaries via a system package manager, such as apt-get, to ensure a secure installation.
Related vulnerabilities
Recent vulnerabilities recorded for cmake.
