CVE-2016-10655: Insecure Download of Executable in clang-extra
Summary
CVE-2016-10655: clang-extra downloads Resources over HTTP. Affects clang-extra versions < 0.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
clang-extra is an npm package that provides additional functionality for the Clang compiler. It is commonly used in software development projects to enhance the capabilities of the Clang compiler. However, versions of clang-extra prior to 0.1.1 are vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in clang-extra arises from the insecure download of an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This could lead to code execution on the system running clang-extra. The package author has stated that no patch is currently available for this vulnerability, as it relies on llvm providing HTTPS support. The best mitigation option is to avoid installing this package while connected to a public network.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To work around this vulnerability, it is recommended to avoid installing clang-extra while connected to a public network. If you need to use the package, ensure that you are on a private network and limit access to trusted individuals who have not compromised your network or have privileged access to your ISP.
Conclusion
In summary, versions of clang-extra prior to 0.1.1 are vulnerable to an insecure download of an executable over an unencrypted HTTP connection. No patch is currently available, and the best mitigation is to avoid installing the package while connected to a public network. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for clang-extra →
FAQ
clang-extra is an npm package that provides additional functionality for the Clang compiler.
The impact of this vulnerability is that an attacker with a privileged network position can replace the downloaded executable with a malicious one, potentially leading to code execution on the system running clang-extra.
No, there is currently no patch available for this vulnerability. The package author has stated that a patch would be possible if llvm provides HTTPS support in the future.
The recommended mitigation is to avoid installing clang-extra while connected to a public network. If the package is installed on a private network, the risk of exploitation is limited to those who have compromised your network or have privileged access to your ISP.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
