CVE-2016-10577 (published 2018-05-29T20:29Z)

ibm_db is an asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix. ibm_db before 1.0.2 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-310
cwe_name: Cryptographic Issues
description: Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

Fix information:
repo_url: https://github.com/ibmdb/node-ibm_db
commit_details: repo_url: https://github.com/ibmdb/node-ibm_db
author: bimalkjha
author_date: 2017-01-03 21:28:34+05:30
msg: fix for issue #208
repository: repo_url: https://github.com/ibmdb/node-ibm_db
repo_name: ibmdb/node-ibm_db
description: IBM DB2 and IBM Informix bindings for node
repo_language: JavaScript
owner: ibmdb
file_changes: filename: driverInstall.js
change_type: ModificationType.MODIFY
diff: @@ -4,12 +4,12 @@
 
 var fs = require('fs');
 var url = require('url');
-var http = require('http');
+var http = require('https');
 var os = require('os');
 var path = require('path');
 var exec = require('child_process').exec;
 
-var installerURL = 'http://public.dhe.ibm.com/ibmdl/export/pub/software/data/db2/drivers/odbc_cli/';
+var installerURL = 'https://public.dhe.ibm.com/ibmdl/export/pub/software/data/db2/drivers/odbc_cli';
 var CURRENT_DIR = process.cwd();
 var DOWNLOAD_DIR = path.resolve(CURRENT_DIR, 'installer');
 var INSTALLER_FILE; 
@@ -31,7 +31,6 @@ var download_file_httpget = function(file_url) {
     var IBM_DB_HOME, IBM_DB_INCLUDE, IBM_DB_LIB, IBM_DB_DIR;
     
     if(platform == 'win32') {
-        
         if(arch == 'x64') {
             var BUILD_FILE = path.resolve(CURRENT_DIR, 'build.zip');
             readStream = fs.createReadStream(BUILD_FILE);
@@ -220,7 +219,11 @@ var download_file_httpget = function(file_url) {
             }
             data.copy( buf, byteIndex );
             byteIndex += data.length;
+            process.stdout.write((platform == 'win32') ? "\033[0G": "\r");
+            process.stdout.write("Downloaded " + (100.0 * byteIndex / fileLength).toFixed(2) + 
+                                 "% (" + byteIndex + " bytes)");
          }).on('end', function() {
+             console.log("\n");
              if( byteIndex != buf.length ) 
              {
                 console.log( "Error downloading IBM ODBC and CLI Driver from " +
@@ -254,7 +257,7 @@ var download_file_httpget = function(file_url) {
         else 
         {
             var targz = require('targz');
-            var compress = targz.decompress({src: INSTALLER_FILE, dest: "DOWNLOAD_DIR"}, function(err){
+            var compress = targz.decompress({src: INSTALLER_FILE, dest: DOWNLOAD_DIR}, function(err){
               if(err) {
                 console.log(err);
                 process.exit(1);
@@ -294,7 +297,7 @@ var download_file_httpget = function(file_url) {
             if(platform == 'darwin' && arch == 'x64') 
             {
                 // Run the install_name_tool
-                var nameToolCommand = "install_name_tool -change libdb2.dylib $IBM_DB_HOME/lib/libdb2.dylib ./build/Release/odbc_bindings.node"
+                var nameToolCommand = "install_name_tool -change libdb2.dylib $IBM_DB_HOME/lib/libdb2.dylib ./build/Release/odbc_bindings.node" ;
                 var nameToolCmdProcess = exec(nameToolCommand , 
                   function (error1, stdout1, stderr1) {
                     if (error1 !== null) {
@@ -341,7 +344,7 @@ var download_file_httpget = function(file_url) {
     {
         var options = {
              host: url.parse(installerfileURL).host,
-             port: 80,
+             port: 443,
              path: url.parse(installerfileURL).pathname
             };
         var proxyStr;

programming_language: TypeScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
   "description": "IBM DB2 and IBM Informix bindings for node",
   "version": "1.0.2",
   "main": "lib/odbc.js",
-  "homepage": "http://github.com/ibmdb/node-ibm_db/",
+  "homepage": "https://github.com/ibmdb/node-ibm_db/",
   "repository": {
     "type": "git",
     "url": "git://github.com/ibmdb/node-ibm_db.git"

programming_language: JavaScript