CVE-2016-10646: Insecure Download of Executable in resourcehacker
Summary
CVE-2016-10646: Downloads Resources over HTTP in resourcehacker. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
resourcehacker is an npm package that allows users to manipulate resources in Windows executables. It provides functionality to view, modify, add, or delete resources such as icons, bitmaps, dialogs, and more. However, this package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The affected versions of resourcehacker insecurely download an executable over an unencrypted HTTP connection. This vulnerability can be exploited by an attacker with a privileged network position. They can intercept the response and replace the executable with a malicious one, leading to code execution on the system running resourcehacker.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The resourcehacker package is vulnerable to an insecure download of an executable. It is recommended to avoid using this package and consider alternative solutions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for resourcehacker →
FAQ
resourcehacker is an npm package used to manipulate resources in Windows executables.
The vulnerability allows an attacker to replace the downloaded executable with a malicious one, potentially leading to code execution on the system running resourcehacker.
No, there is currently no patch available for this vulnerability.
To mitigate the risk, avoid using the resourcehacker package and consider using an alternative package. If the package is installed on a private network, the potential attackers are limited to those who have compromised your network or have privileged access to your ISP.
Yes, you can use resourcehacker on a private network, but be aware of the potential risks and ensure that your network is secure.
