Data Handling in nodejs (Alpine package)

1) Data Handling

EUVDB-ID: #VU32225

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7099

CWE-ID: CWE-19 - Data Handling

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

Mitigation

Install update from vendor's website.

Vulnerable software versions

nodejs (Alpine package): 0.10.20-r0 - 6.6.0-r0

CPE2.3

• cpe:2.3:o:alpine:nodejs_alpine_package:0.10.33-r0:*:*:*:*:alpine_linux:*:
• cpe:2.3:o:alpine:nodejs_alpine_package:0.10.28-r0:*:*:*:*:alpine_linux:*:
• cpe:2.3:o:alpine:nodejs_alpine_package:0.10.42-r0:*:*:*:*:alpine_linux:*:

External links

http://git.alpinelinux.org/aports/commit/?id=8ffd18baa02a14a04ea58debd2c12ae688502b5f
http://git.alpinelinux.org/aports/commit/?id=d1d56c01fa298888ca574ef66eb75d5ddbfad4cf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.