Symlink Attack Vulnerability in Node.js Packages on Ubuntu: CVE-2014-0177
Summary
UBUNTU-CVE-2014-0177: The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file. Affects nodejs versions 0.10.15~dfsg1-4 – 0.10.25~dfsg2-2ubuntu1.2+esm2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine, widely used for building scalable network applications. The affected versions of Node.js in Ubuntu 14.04, 16.04, and 18.04 LTS are vulnerable to a symlink attack due to improper handling of temporary patch files in the hub command library, which can lead to unauthorized file overwrites.
Vulnerability Detail
The vulnerability identified as CVE-2014-0177 exists in the 'am' function located in lib/hub/commands.rb in the hub package prior to version 1.12.1. It allows local users to exploit a symlink attack, which can overwrite arbitrary files by creating a symbolic link to a temporary patch file. This can lead to data loss or unauthorized access to sensitive files, posing a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the vulnerable 'am' function in the hub package until an update can be applied. Additionally, ensure that proper file permissions are set to limit access to sensitive files.
Conclusion
CVE-2014-0177 is a significant vulnerability affecting Node.js packages on Ubuntu systems, allowing local users to exploit symlink attacks. It is crucial to update to the patched versions of the affected packages and monitor for vulnerabilities to maintain system security.
See every vulnerability recorded for nodejs →
FAQ
CVE-2014-0177 is a vulnerability in the hub command library used in Node.js that allows local users to overwrite arbitrary files via a symlink attack.
The affected versions include nodejs on Ubuntu 14.04, 16.04, and 18.04 LTS prior to their respective patched versions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against CVE-2014-0177 using the Vulert playground at Vulert Scanner.
Exploiting this vulnerability can lead to unauthorized file access, data loss, and potential system compromise.
Regularly update your packages to the latest patched versions and monitor your applications for vulnerabilities using tools like Vulert.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
