Detections
Analytics
FreeBSD : node.js -- multiple vulnerabilities (5a9bbb6e-32d3-11e8-a769-6daaba161086)
high Nessus Plugin ID 108738
Language:
Synopsis
The remote FreeBSD host is missing one or more security-related updates.Description
Node.js reports : Node.js Inspector DNS rebinding vulnerability (CVE-2018-7160) Node.js 6.x and later include a debugger protocol (also known as 'inspector') that can be activated by the --inspect and related command line flags. This debugger service was vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. 'path' module regular expression denial of service (CVE-2018-7158) The 'path' module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. Spaces in HTTP Content-Length header values are ignored (CVE-2018-7159) The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as Content-Length: 1 2 to be interpreted as having a value of 12. The HTTP specification does not allow for spaces in the Content-Length value and the Node.js HTTP parser has been brought into line on this particular difference.Solution
Update the affected packages.See Also
https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/
Plugin Details
Severity: High
ID: 108738
File Name: freebsd_pkg_5a9bbb6e32d311e8a7696daaba161086.nasl
Version: 1.4
Type: local
Family: FreeBSD Local Security Checks
Published: 3/30/2018
Updated: 11/10/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability Information
CPE: p-cpe:/a:freebsd:freebsd:node, p-cpe:/a:freebsd:freebsd:node4, p-cpe:/a:freebsd:freebsd:node6, p-cpe:/a:freebsd:freebsd:node8, cpe:/o:freebsd:freebsd
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Patch Publication Date: 3/28/2018
Vulnerability Publication Date: 3/21/2018