CVE-2016-10668: Insecure Download of Resources in libsbml
Summary
CVE-2016-10668: libsbml downloads Resources over HTTP. Affects libsbml versions < 0.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libsbml is an npm package that provides a library for working with Systems Biology Markup Language (SBML) files. SBML is a standard format for representing biological models. libsbml allows users to read, write, and manipulate SBML files programmatically. However, versions of libsbml prior to 0.0.3 are vulnerable to an insecure download of resources over HTTP.
Vulnerability Detail
The vulnerability in libsbml involves insecurely downloading an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. As a result, code execution on the system running libsbml can be achieved. The risk of exploitation is higher when connected to a public network, but even on a private network, the vulnerability can be exploited by those who have compromised the network or have privileged access to the ISP.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The best course of action is to follow the recommended mitigation steps mentioned above.
Conclusion
In conclusion, libsbml versions prior to 0.0.3 are vulnerable to an insecure download of resources over HTTP. No patch is available, and the package has not been updated since 2013. It is recommended to avoid using this package and opt for an alternative if possible. If you must use libsbml, take precautions by not installing the package while connected to a public network. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libsbml →
FAQ
libsbml is an npm package that provides a library for working with Systems Biology Markup Language (SBML) files. SBML is a standard format for representing biological models.
The impact of this vulnerability is that an attacker can intercept the download of an executable over an unencrypted HTTP connection and replace it with a malicious one. This can lead to code execution on the system running libsbml.
No, there is currently no patch available for this vulnerability, and the package has not been updated since 2013.
It is recommended to avoid using libsbml due to this vulnerability. If you must use it, ensure that the package is not installed while connected to a public network to reduce the risk of exploitation.
To mitigate the risk of exploitation, avoid using libsbml if possible. If you must use it, ensure that the package is not installed while connected to a public network. This limits the potential attackers to those who have compromised your network or have privileged access to your ISP.
