SUSE SLES12 Security Update : nodejs4, nodejs6 (SUSE-SU-2017:2168-1)

Medium Nessus Plugin ID 120002

Synopsis

The remote SUSE host is missing one or more security updates.

Description

This update for nodejs4 and nodejs6 fixes the following issues:
Security issues fixed :

- CVE-2017-1000381: The c-ares function ares_parse_naptr_reply() could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.
(bsc#1044946)

- CVE-2017-11499: Disable V8 snapshots. The hashseed embedded in the snapshot is currently the same for all runs of the binary. This opens node up to collision attacks which could result in a Denial of Service. We have temporarily disabled snapshots until a more robust solution is found. (bsc#1048299) Non-security fixes :

- GCC 7 compilation fixes for v8 backported and add missing ICU59 headers (bsc#1041282)

- New upstream LTS release 6.11.1 https://github.com/nodejs/node/blob/master/doc/changelog s/CHANGELOG_V6.md#6 .11.1

- New upstream LTS release 6.11.0 https://github.com/nodejs/node/blob/master/doc/changelog s/CHANGELOG_V6.md#6 .11.0

- New upstream LTS release 6.10.3 https://github.com/nodejs/node/blob/master/doc/changelog s/CHANGELOG_V6.md#6 .10.3

- New upstream LTS release 6.10.2 https://github.com/nodejs/node/blob/master/doc/changelog s/CHANGELOG_V6.md#6 .10.2

- New upstream LTS release 6.10.1 https://github.com/nodejs/node/blob/master/doc/changelog s/CHANGELOG_V6.md#6 .10.1

- New upstream LTS release 6.10.0 https://github.com/nodejs/node/blob/master/doc/changelog s/CHANGELOG_V6.md#6 .10.0

- New upstream LTS release 4.8.4 https://github.com/nodejs/node/blob/master/doc/changelog s/CHANGELOG_V4.md#4 .8.4

- New upstream LTS release 4.8.3 https://github.com/nodejs/node/blob/master/doc/changelog s/CHANGELOG_V4.md#4 .8.3

- New upstream LTS release 4.8.2 https://github.com/nodejs/node/blob/master/doc/changelog s/CHANGELOG_V4.md#4 .8.2

- New upstream LTS release 4.8.1 https://github.com/nodejs/node/blob/master/doc/changelog s/CHANGELOG_V4.md#4 .8.1

- New upstream LTS release 4.8.0 https://github.com/nodejs/node/blob/master/doc/changelog s/CHANGELOG_V4.md#4 .8.0

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE OpenStack Cloud 7:zypper in -t patch SUSE-OpenStack-Cloud-7-2017-1331=1

SUSE Linux Enterprise Module for Web Scripting 12:zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2017-1331=1

SUSE Enterprise Storage 4:zypper in -t patch SUSE-Storage-4-2017-1331=1

To bring your system up-to-date, use 'zypper patch'.

See Also

https://bugzilla.suse.com/show_bug.cgi?id=1041282

https://bugzilla.suse.com/show_bug.cgi?id=1041283

https://bugzilla.suse.com/show_bug.cgi?id=1044946

https://bugzilla.suse.com/show_bug.cgi?id=1048299

http://www.nessus.org/u?c242247b

http://www.nessus.org/u?15cdcfe6

https://www.suse.com/security/cve/CVE-2017-1000381/

https://www.suse.com/security/cve/CVE-2017-11499/

http://www.nessus.org/u?e75b1040

Plugin Details

Severity: Medium

ID: 120002

File Name: suse_SU-2017-2168-1.nasl

Version: 1.3

Type: local

Agent: unix

Published: 2019/01/02

Updated: 2020/03/23

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:nodejs4, p-cpe:/a:novell:suse_linux:nodejs4-debuginfo, p-cpe:/a:novell:suse_linux:nodejs4-debugsource, p-cpe:/a:novell:suse_linux:nodejs4-devel, p-cpe:/a:novell:suse_linux:nodejs6, p-cpe:/a:novell:suse_linux:nodejs6-debuginfo, p-cpe:/a:novell:suse_linux:nodejs6-debugsource, p-cpe:/a:novell:suse_linux:nodejs6-devel, p-cpe:/a:novell:suse_linux:npm4, p-cpe:/a:novell:suse_linux:npm6, cpe:/o:novell:suse_linux:12

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 2017/08/15

Vulnerability Publication Date: 2017/07/07

Reference Information

CVE: CVE-2017-1000381, CVE-2017-11499