CVE-2016-10674: Insecure Download of Executable in limbus-buildgen
Summary
CVE-2016-10674: Downloads Resources over HTTP in limbus-buildgen. Affects limbus-buildgen versions < 0.1.1. Fixed in 0.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
limbus-buildgen is an npm package used for generating build files in the Limbus framework. It is responsible for downloading resources required for the build process. However, certain versions of limbus-buildgen insecurely download an executable over an unencrypted HTTP connection. This vulnerability allows an attacker with a privileged network position to intercept the response and replace the executable with a malicious one, potentially leading to code execution on the system running limbus-buildgen.
Vulnerability Detail
The vulnerability in limbus-buildgen arises from the insecure download of an executable over an unencrypted HTTP connection. This means that if an attacker has control over the network traffic, they can intercept the response and replace the downloaded executable with a malicious one. As a result, when the executable is executed by limbus-buildgen, the attacker's code will be executed instead. This can lead to various consequences, including unauthorized access, data theft, or even complete compromise of the system running limbus-buildgen.
How To Fix
Minimum fixed version
0.1.1
This is the first release that contains the fix.
npm install limbus-buildgen@0.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to update to the latest version of limbus-buildgen as soon as possible.
Conclusion
The vulnerability in limbus-buildgen allows for the insecure download of an executable, which can be intercepted and replaced by an attacker. To mitigate this vulnerability, it is crucial to update to version 0.1.1 or later of limbus-buildgen. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for limbus-buildgen →
FAQ
limbus-buildgen is an npm package used for generating build files in the Limbus framework. It automates the process of downloading resources required for the build.
The vulnerability allows an attacker to replace the downloaded executable with a malicious one, potentially leading to code execution on the system running limbus-buildgen. This can result in unauthorized access, data theft, or complete compromise of the system.
To mitigate this vulnerability, update to version 0.1.1 or later of limbus-buildgen, which ensures secure downloading of executables over HTTPS.
No, only versions prior to 0.1.1 are affected. Updating to version 0.1.1 or later resolves the vulnerability.
There is no known exploit of this vulnerability at the moment. However, it is important to update to the latest version of limbus-buildgen to prevent any potential exploitation.
