CVE-2016-10694: Insecure Download of Executable in alto-saxophone
Summary
CVE-2016-10694: Downloads Resources over HTTP in alto-saxophone. Affects alto-saxophone versions < 2.25.1. Fixed in 2.25.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
alto-saxophone is an npm package used for downloading resources. It allows users to fetch files over HTTP and perform various operations on them. However, certain versions of alto-saxophone have a vulnerability that exposes users to potential code execution attacks. This vulnerability arises from the insecure download of an executable over an unencrypted HTTP connection. If an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one, leading to code execution on the system running alto-saxophone.
Vulnerability Detail
The vulnerability in alto-saxophone involves the insecure download of an executable over an unencrypted HTTP connection. This allows an attacker with a privileged network position to intercept the response and replace the executable with a malicious one. As a result, when the executable is executed on the system running alto-saxophone, the attacker's code will be executed instead. This can lead to various malicious activities, such as unauthorized access, data theft, or system compromise.
How To Fix
Minimum fixed version
2.25.1
This is the first release that contains the fix.
npm install alto-saxophone@2.25.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in alto-saxophone that allows for the insecure download of an executable poses a significant risk to systems running this package. To mitigate this risk, it is crucial to update to version 2.25.1 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for alto-saxophone →
FAQ
The vulnerability allows an attacker to replace the downloaded executable with a malicious one, leading to code execution on the system running alto-saxophone. This can result in unauthorized access, data theft, or system compromise.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the moment, there are no known workarounds for this vulnerability. It is recommended to update to the latest version of alto-saxophone to ensure the issue is resolved.
Yes, this vulnerability can be exploited remotely if the attacker has a privileged network position. By intercepting the response and replacing the executable, the attacker can execute their code on the system running alto-saxophone.
There is no specific evidence of this vulnerability being actively exploited. However, it is always recommended to apply security updates and patches to mitigate potential risks.
