CVE-2016-10647: Insecure Download of Resources in node-air-sdk
Summary
CVE-2016-10647: Downloads Resources over HTTP in node-air-sdk. Affects node-air-sdk versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
node-air-sdk is an npm package that provides a development framework for creating Adobe AIR applications using Node.js. It allows developers to build cross-platform desktop applications using web technologies. The package is widely used in the Node.js ecosystem for AIR application development.
Vulnerability Detail
Affected versions of node-air-sdk insecurely download an executable over an unencrypted HTTP connection. This vulnerability can be exploited by an attacker with a privileged network position. They can intercept the response and replace the executable with a malicious one, leading to code execution on the system running node-air-sdk. The risk of exploitation is higher when connected to a public network, but even on a private network, it can be exploited by those who have compromised your network or have privileged access to your ISP.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The node-air-sdk package is affected by a vulnerability that allows for the insecure download of resources. It is recommended to avoid using this package and opt for alternatives if possible. If you must use node-air-sdk, take precautions by not installing it while connected to a public network and ensuring the security of your network. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for node-air-sdk →
FAQ
node-air-sdk is an npm package that provides a development framework for creating Adobe AIR applications using Node.js.
The vulnerability allows an attacker to replace the downloaded executable with a malicious one, potentially leading to code execution on the system running node-air-sdk.
To mitigate the risk, avoid using node-air-sdk and consider using an alternative package. If you must use node-air-sdk, do not install it while connected to a public network and ensure your network is secure.
No, there is currently no patch available for this vulnerability.
This vulnerability can be exploited by attackers with a privileged network position, those who have compromised your network, or individuals with privileged access to your ISP.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
