CVE-2016-10577: Cryptographic Issues (CWE-310)
value: ibm_db is an asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix. ibm_db before 1.0.2 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CWE description: Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
CVSS v3 base score: 8.1
Published: 2018-05-29T20:29Z
Repository: https://github.com/ibmdb/node-ibm_db
Language: JSON
Files changed: installer/driverInstall.js, package.json
Commit date: 2017-01-03 21:28:34 +0530
Commit message: fix for issue #208

Diff: diff --git a/installer/driverInstall.js b/installer/driverInstall.js
index 1cf082c..93164fe 100644
--- a/installer/driverInstall.js
+++ b/installer/driverInstall.js
@@ -2,16 +2,16 @@
  * New node file
  */
 
 var fs = require('fs');
 var url = require('url');
-var http = require('http');
+var http = require('https');
 var os = require('os');
 var path = require('path');
 var exec = require('child_process').exec;
 
-var installerURL = 'http://public.dhe.ibm.com/ibmdl/export/pub/software/data/db2/drivers/odbc_cli/';
+var installerURL = 'https://public.dhe.ibm.com/ibmdl/export/pub/software/data/db2/drivers/odbc_cli';
 var CURRENT_DIR = process.cwd();
 var DOWNLOAD_DIR = path.resolve(CURRENT_DIR, 'installer');
 var INSTALLER_FILE; 
 installerURL = process.env.IBM_DB_INSTALLER_URL || installerURL;
 installerURL = installerURL + "/";
@@ -29,11 +29,10 @@ var download_file_httpget = function(file_url) {
     var unzip = require('unzip');
                 
     var IBM_DB_HOME, IBM_DB_INCLUDE, IBM_DB_LIB, IBM_DB_DIR;
     
     if(platform == 'win32') {
-        
         if(arch == 'x64') {
             var BUILD_FILE = path.resolve(CURRENT_DIR, 'build.zip');
             readStream = fs.createReadStream(BUILD_FILE);
             writeStream = fstream.Writer(CURRENT_DIR);
 
@@ -218,11 +217,15 @@ var download_file_httpget = function(file_url) {
                      installerfileURL );
                 process.exit(1);
             }
             data.copy( buf, byteIndex );
             byteIndex += data.length;
+            process.stdout.write((platform == 'win32') ? "\033[0G": "\r");
+            process.stdout.write("Downloaded " + (100.0 * byteIndex / fileLength).toFixed(2) + 
+                                 "% (" + byteIndex + " bytes)");
          }).on('end', function() {
+             console.log("\n");
              if( byteIndex != buf.length ) 
              {
                 console.log( "Error downloading IBM ODBC and CLI Driver from " +
                      installerfileURL );
                 process.exit(1);
@@ -252,11 +255,11 @@ var download_file_httpget = function(file_url) {
             console.log(license_agreement);
         } 
         else 
         {
             var targz = require('targz');
-            var compress = targz.decompress({src: INSTALLER_FILE, dest: "DOWNLOAD_DIR"}, function(err){
+            var compress = targz.decompress({src: INSTALLER_FILE, dest: DOWNLOAD_DIR}, function(err){
               if(err) {
                 console.log(err);
                 process.exit(1);
               }
               else {
@@ -292,11 +295,11 @@ var download_file_httpget = function(file_url) {
             }
 
             if(platform == 'darwin' && arch == 'x64') 
             {
                 // Run the install_name_tool
-                var nameToolCommand = "install_name_tool -change libdb2.dylib $IBM_DB_HOME/lib/libdb2.dylib ./build/Release/odbc_bindings.node"
+                var nameToolCommand = "install_name_tool -change libdb2.dylib $IBM_DB_HOME/lib/libdb2.dylib ./build/Release/odbc_bindings.node" ;
                 var nameToolCmdProcess = exec(nameToolCommand , 
                   function (error1, stdout1, stderr1) {
                     if (error1 !== null) {
                         console.log('Error setting up the lib path to ' +
                             'odbc_bindings.node file.Error trace:\n'+error1);
@@ -339,11 +342,11 @@ var download_file_httpget = function(file_url) {
     
     function buildHttpOptions(installerfileURL) 
     {
         var options = {
              host: url.parse(installerfileURL).host,
-             port: 80,
+             port: 443,
              path: url.parse(installerfileURL).pathname
             };
         var proxyStr;
         
         var child = exec('npm config get proxy', function(error, stdout, stderr)
diff --git a/package.json b/package.json
index 1a18419..96243e7 100644
--- a/package.json
+++ b/package.json
@@ -1,11 +1,11 @@
 {
   "name": "ibm_db",
   "description": "IBM DB2 and IBM Informix bindings for node",
   "version": "1.0.2",
   "main": "lib/odbc.js",
-  "homepage": "http://github.com/ibmdb/node-ibm_db/",
+  "homepage": "https://github.com/ibmdb/node-ibm_db/",
   "repository": {
     "type": "git",
     "url": "git://github.com/ibmdb/node-ibm_db.git"
   },
   "bugs": {

Vulnerable code: var http = require('http');
var installerURL = 'http://public.dhe.ibm.com/ibmdl/export/pub/software/data/db2/drivers/odbc_cli/';
        
            var compress = targz.decompress({src: INSTALLER_FILE, dest: "DOWNLOAD_DIR"}, function(err){
                var nameToolCommand = "install_name_tool -change libdb2.dylib $IBM_DB_HOME/lib/libdb2.dylib ./build/Release/odbc_bindings.node"
             port: 80,
  "homepage": "http://github.com/ibmdb/node-ibm_db/",
Fixed code: var http = require('https');
var installerURL = 'https://public.dhe.ibm.com/ibmdl/export/pub/software/data/db2/drivers/odbc_cli';
            process.stdout.write((platform == 'win32') ? "\033[0G": "\r");
            process.stdout.write("Downloaded " + (100.0 * byteIndex / fileLength).toFixed(2) + 
                                 "% (" + byteIndex + " bytes)");
             console.log("\n");
            var compress = targz.decompress({src: INSTALLER_FILE, dest: DOWNLOAD_DIR}, function(err){
                var nameToolCommand = "install_name_tool -change libdb2.dylib $IBM_DB_HOME/lib/libdb2.dylib ./build/Release/odbc_bindings.node" ;
             port: 443,
  "homepage": "https://github.com/ibmdb/node-ibm_db/",