The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before     0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-     splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by     %c4%8d%c4%8a. (CVE-2016-2216)

Note that Nessus relies on the presence of the package as reported by the vendor.

The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.
(CVE-2016-2216)

The remote host is affected by the vulnerability described in GLSA-201612-43 (Node.js: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Node.js. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition, or       conduct man-in-the-middle attacks.
  Workaround :

    There is no known workaround at this time.

The version of Apple Xcode installed on the remote macOS or Mac OS X host is prior to 8.1. It is, therefore, affected by multiple remote code execution vulnerabilities in the Node.js component of the Xcode Server. An unauthenticated, remote attacker can exploit these vulnerabilities to cause a denial of service condition or the execution of arbitrary code.

Security fix for CVE-2016-2216, CVE-2016-2086

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs fixes the following issues :

  - CVE-2016-2216: Response splitting vulnerability using     Unicode characters (boo#966076)

  - CVE-2016-2086: Request smuggling vulnerability     (boo#966077)

Node.js was updated to the 4.3.1 LTS version, containing all upstream bug fixes and improvements.

ID	Name	Product	Family	Severity
253916	Linux Distros Unpatched Vulnerability : CVE-2016-2216	Nessus	Misc.	high
97838	F5 Networks BIG-IP : Node.js vulnerability (K23134279)	Nessus	F5 Networks Local Security Checks	high
95817	GLSA-201612-43 : Node.js: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
94935	Apple Xcode < 8.1 Node.js Multiple RCE (macOS)	Nessus	MacOS X Local Security Checks	critical
89575	Fedora 22 : nodejs-0.10.42-4.fc22 (2016-8925b6119f)	Nessus	Fedora Local Security Checks	high
89508	Fedora 23 : nodejs-0.10.42-4.fc23 (2016-3102c11757)	Nessus	Fedora Local Security Checks	high
89019	openSUSE Security Update : nodejs (openSUSE-2016-283)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2016-2216

high

Tenable Plugins

high

high

high

critical

high

high

high