The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0002 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    The following packages have been upgraded to a newer upstream version: rh-nodejs4-nodejs (4.6.2), rh-     nodejs4-http-parser (2.7.0). (BZ#1388097)

    Security Fix(es):

    * It was found that Node.js' tls.checkServerIdentity() function did not properly validate server     certificates containing wildcards. A malicious TLS server could use this flaw to get a specially crafted     certificate accepted by a Node.js TLS client. (CVE-2016-7099)

    * It was found that the V8 Zone class was vulnerable to integer overflow when allocating new memory     (Zone::New() and Zone::NewExpand()). An attacker with the ability to manipulate a large zone could crash     the application or, potentially, execute arbitrary code with the application privileges. (CVE-2016-1669)

    * A vulnerability was found in c-ares, a DNS resolver library bundled with Node.js. A hostname with an     escaped trailing dot would have its size calculated incorrectly, leading to a single byte written beyond     the end of a buffer on the heap. An attacker able to provide such a hostname to an application using     c-ares, could potentially cause that application to crash. (CVE-2016-5180)

    * It was found that the reason argument in ServerResponse#writeHead() was not properly validated. A remote     attacker could possibly use this flaw to conduct an HTTP response splitting attack via a specially-crafted     HTTP request. (CVE-2016-5325)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4796-1 advisory.

    Alexander Minozhenko and James Bunton discovered that Node.js did not properly handle wildcards in name     fields of X.509 TLS certificates. An attacker could use this vulnerability to execute a machine-in-the-     middle- attack. This issue only affected Ubuntu 14.04 ESM and 16.04 ESM. (CVE-2016-7099)

    It was discovered that Node.js incorrectly handled certain NAPTR responses. A remote attacker could     possibly use this issue to cause applications using Node.js to crash, resulting in a denial of service.
    This issue only affected Ubuntu 16.04 ESM. (CVE-2017-1000381)

    Nikita Skovoroda discovered that Node.js mishandled certain input, leading to an out of bounds write. An     attacker could use this vulnerability to cause a denial of service (crash) or possibly execute arbitrary     code. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-12115)

    Arkadiy Tetelman discovered that Node.js improperly handled certain malformed HTTP requests. An attacker     could use this vulnerability to inject unexpected HTTP requests. This issue only affected Ubuntu 18.04     ESM. (CVE-2018-12116)

    Jan Maybach discovered that Node.js did not time out if incomplete HTTP/HTTPS headers were received. An     attacker could use this vulnerability to cause a denial of service by keeping HTTP/HTTPS connections alive     for a long period of time. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-12122)

    Martin Bajanik discovered that the url.parse() method would return incorrect results if it received     specially crafted input. An attacker could use this vulnerability to spoof the hostname and bypass     hostname-specific security controls. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-12123)

    It was discovered that Node.js is vulnerable to a DNS rebinding attack which could be exploited to perform     remote code execution. An attack is possible from malicious websites open in a web browser with network     access to the system running the Node.js process. This issue only affected Ubuntu 18.04 ESM.
    (CVE-2018-7160)

    It was discovered that the Buffer.fill() and Buffer.alloc() methods improperly handled certain inputs. An     attacker could use this vulnerability to cause a denial of service. This issue only affected Ubuntu 18.04     ESM. (CVE-2018-7167)

    Marco Pracucci discovered that Node.js mishandled HTTP and HTTPS connections. An attacker could use this     vulnerability to cause a denial of service. This issue only affected Ubuntu 18.04 ESM. (CVE-2019-5737)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update brings the new upstream nodejs LTS version 4.6.0, fixing bugs and security issues :

  - Nodejs embedded openssl version update

  + upgrade to 1.0.2j (CVE-2016-6304, CVE-2016-2183,     CVE-2016-2178, CVE-2016-6306, CVE-2016-7052)

  + remove support for dynamic 3rd party engine modules

- http: Properly validate for allowable characters in input user data.
This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here.
  (CVE-2016-5325, bsc#985201)

  - tls: properly validate wildcard certificates     (CVE-2016-7099, bsc#1001652)

  - buffer: Zero-fill excess bytes in new Buffer objects     created with Buffer.concat()

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

https://nodejs.org/en/blog/release/v6.7.0/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update brings the new upstream nodejs LTS version 4.6.0, fixing bugs and security issues :

  - Nodejs embedded openssl version update

  + upgrade to 1.0.2j (CVE-2016-6304, CVE-2016-2183,     CVE-2016-2178, CVE-2016-6306, CVE-2016-7052)

  + remove support for dynamic 3rd party engine modules

- http: Properly validate for allowable characters in input user data. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here.
  (CVE-2016-5325, bsc#985201)

  - tls: properly validate wildcard certificates     (CVE-2016-7099, bsc#1001652)

  - buffer: Zero-fill excess bytes in new Buffer objects     created with Buffer.concat()

https://nodejs.org/en/blog/release/v4.6.0/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
210197	RHEL 6 / 7 : rh-nodejs4-nodejs and rh-nodejs4-http-parser (RHSA-2017:0002)	Nessus	Red Hat Local Security Checks	critical
183156	Ubuntu 16.04 ESM / 18.04 ESM : Node.js vulnerabilities (USN-4796-1)	Nessus	Ubuntu Local Security Checks	high
119982	SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2016:2470-1)	Nessus	SuSE Local Security Checks	high
94798	Fedora 25 : 1:nodejs (2016-43ff70c6b1)	Nessus	Fedora Local Security Checks	medium
94002	openSUSE Security Update : nodejs (openSUSE-2016-1172)	Nessus	SuSE Local Security Checks	high
93977	Fedora 24 : 1:nodejs (2016-861b8c46b7)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2016-7099

medium

Tenable Plugins

critical

high

high

medium

high

medium