FreeBSD : node.js -- multiple vulnerabilities (3eff66c5-66c9-11e7-aa1d-3d2e663cef42)

high Nessus Plugin ID 101539

Language:

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

Updates are now available for all active Node.js release lines as well as the 7.x line. These include the fix for the high severity vulnerability identified in the initial announcement, one additional lower priority Node.js vulnerability in the 4.x release line, as well as some lower priority fixes for Node.js dependencies across the current release lines. Constant Hashtable Seeds (CVE pending) Node.js was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be overwritten on startup. Thanks to Jann Horn of Google Project Zero for reporting this vulnerability.

This is a high severity vulnerability and applies to all active release lines (4.x, 6.x, 8.x) as well as the 7.x line. http.get with numeric authorization options creates uninitialized buffers Application code that allows the auth field of the options object used with http.get() to be set to a number can result in an uninitialized buffer being created/used as the authentication string.

This is a low severity defect and only applies to the 4.x release line.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 101539

File Name: freebsd_pkg_3eff66c566c911e7aa1d3d2e663cef42.nasl

Version: 3.3

Type: local

Family: FreeBSD Local Security Checks

Published: 7/14/2017

Updated: 1/4/2021

Supported Sensors: Nessus

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:node, cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:node4, p-cpe:/a:freebsd:freebsd:node6

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 7/12/2017

Vulnerability Publication Date: 6/27/2017

Detections

Analytics