CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0002 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    The following packages have been upgraded to a newer upstream version: rh-nodejs4-nodejs (4.6.2), rh-     nodejs4-http-parser (2.7.0). (BZ#1388097)

    Security Fix(es):

    * It was found that Node.js' tls.checkServerIdentity() function did not properly validate server     certificates containing wildcards. A malicious TLS server could use this flaw to get a specially crafted     certificate accepted by a Node.js TLS client. (CVE-2016-7099)

    * It was found that the V8 Zone class was vulnerable to integer overflow when allocating new memory     (Zone::New() and Zone::NewExpand()). An attacker with the ability to manipulate a large zone could crash     the application or, potentially, execute arbitrary code with the application privileges. (CVE-2016-1669)

    * A vulnerability was found in c-ares, a DNS resolver library bundled with Node.js. A hostname with an     escaped trailing dot would have its size calculated incorrectly, leading to a single byte written beyond     the end of a buffer on the heap. An attacker able to provide such a hostname to an application using     c-ares, could potentially cause that application to crash. (CVE-2016-5180)

    * It was found that the reason argument in ServerResponse#writeHead() was not properly validated. A remote     attacker could possibly use this flaw to conduct an HTTP response splitting attack via a specially-crafted     HTTP request. (CVE-2016-5325)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update brings the new upstream nodejs LTS version 4.6.0, fixing bugs and security issues :

  - Nodejs embedded openssl version update

  + upgrade to 1.0.2j (CVE-2016-6304, CVE-2016-2183,     CVE-2016-2178, CVE-2016-6306, CVE-2016-7052)

  + remove support for dynamic 3rd party engine modules

- http: Properly validate for allowable characters in input user data.
This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here.
  (CVE-2016-5325, bsc#985201)

  - tls: properly validate wildcard certificates     (CVE-2016-7099, bsc#1001652)

  - buffer: Zero-fill excess bytes in new Buffer objects     created with Buffer.concat()

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2101 advisory.

    Red Hat OpenShift Container Platform is the company's cloud computing     Platform-as-a-Service (PaaS) solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * A regular expression denial of service flaw was found in Tough-Cookie. An     attacker able to make an application using Touch-Cookie to parse a     sufficiently large HTTP request Cookie header could cause the application     to consume an excessive amount of CPU. (CVE-2016-1000232)

    * It was found that the reason argument in ServerResponse#writeHead() was     not properly validated. A remote attacker could possibly use this flaw to     conduct an HTTP response splitting attack via a specially-crafted HTTP     request. (CVE-2016-5325)

    This advisory contains the RPM packages for this release. See the following     advisory for the container images fixes for this release:

    https://access.redhat.com/errata/RHBA-2016:2100

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201612-43 (Node.js: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Node.js. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition, or       conduct man-in-the-middle attacks.
  Workaround :

    There is no known workaround at this time.

This update brings the new upstream nodejs LTS version 4.6.0, fixing bugs and security issues :

  - Nodejs embedded openssl version update

  + upgrade to 1.0.2j (CVE-2016-6304, CVE-2016-2183,     CVE-2016-2178, CVE-2016-6306, CVE-2016-7052)

  + remove support for dynamic 3rd party engine modules

- http: Properly validate for allowable characters in input user data. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here.
  (CVE-2016-5325, bsc#985201)

  - tls: properly validate wildcard certificates     (CVE-2016-7099, bsc#1001652)

  - buffer: Zero-fill excess bytes in new Buffer objects     created with Buffer.concat()

ID	Name	Product	Family	Severity
210197	RHEL 6 / 7 : rh-nodejs4-nodejs and rh-nodejs4-http-parser (RHSA-2017:0002)	Nessus	Red Hat Local Security Checks	critical
119982	SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2016:2470-1)	Nessus	SuSE Local Security Checks	high
119383	RHEL 7 : nodejs and nodejs-tough-cookie (RHSA-2016:2101)	Nessus	Red Hat Local Security Checks	medium
95817	GLSA-201612-43 : Node.js: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
94002	openSUSE Security Update : nodejs (openSUSE-2016-1172)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2016-5325

medium

Tenable Plugins

critical

high

medium

high

high