CVE-2016-10577
First published: Tue May 29 2018(Updated: )
Affected versions of `ibm_db` insecurely download resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution. ## Recommendation Update to version 1.0.2 or later.
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/ibm_db | <1.0.2 | 1.0.2 |
| IBM Db2 | <1.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2016-10577
- https://github.com/ibmdb/node-ibm_db/commit/d7e2d4b4cbeb6f067df8bba7d0b2ac5d40fcfc19#diff-315091eb1586966006e05ebc21cd2a94
- https://github.com/advisories/GHSA-c4qp-h3m6-785f (Advisory)
- https://www.npmjs.com/advisories/163
- https://nodesecurity.io/advisories/163
Frequently Asked Questions
What is the severity of CVE-2016-10577?
The severity of CVE-2016-10577 varies based on network conditions and the attacker's capabilities, but it poses a serious risk due to potential unauthorized access to sensitive resources.
How do I fix CVE-2016-10577?
To fix CVE-2016-10577, update the ibm_db package to version 1.0.2 or later to ensure secure resource downloads over HTTPS.
Which versions of ibm_db are affected by CVE-2016-10577?
CVE-2016-10577 affects all versions of ibm_db prior to 1.0.2.
What kind of attack can exploit CVE-2016-10577?
CVE-2016-10577 can be exploited in scenarios where an attacker is in a privileged network position, allowing them to intercept or tamper with insecure HTTP resource downloads.
Is the ibm_db package deprecated in relation to CVE-2016-10577?
No, the ibm_db package is not deprecated, but its older versions prior to 1.0.2 have a significant vulnerability that requires updating to ensure security.
- collector/github-advisory-latest
- alias/GHSA-c4qp-h3m6-785f
- alias/CVE-2016-10577
- collector/github-advisory
- agent/author
- agent/type
- agent/softwarecombine
- agent/weakness
- agent/severity
- agent/remedy
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- package-manager/npm
- vendor/ibm
- canonical/ibm db2