Is CVE-2016-10518 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-10518 being exploited in the wild.

How severe is CVE-2016-10518?

Informational severity, with a CVSS score of 7.5, published 18 February 2019.

Which products and versions are affected?

ws (npm) SEMVER:introduced=0,fixed=1.0.1.

Is there a fix for CVE-2016-10518?

Yes. ws (npm): upgrade to 1.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-10518 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-10518?

Check whether you run ws (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-10518: websockets ws remote memory disclosure via uninitialized buffers

CVE-2016-10518 · Severity: info · CVSS 7.5 · Published 2019-02-18

The 'ws' library, a popular WebSocket implementation for Node.js, contains a vulnerability that can lead to the accidental disclosure of sensitive server or client memory. If an application allows user-provided numbers to be passed into certain communication functions, the library may transmit uninitialized memory buffers instead of the intended data. This could allow an attacker to view fragments of previously processed data, such as passwords, session tokens, or other private information stored in the system's memory.

Technologies: ws (npm). Vendors: npm.

Quick answers

Is CVE-2016-10518 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-10518 being exploited in the wild.
How severe is CVE-2016-10518?: Informational severity, with a CVSS score of 7.5, published 18 February 2019.
Which products and versions are affected?: ws (npm) SEMVER:introduced=0,fixed=1.0.1.
Is there a fix for CVE-2016-10518?: Yes. ws (npm): upgrade to 1.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-10518 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-10518?: Check whether you run ws (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ws (npm): upgrade to 1.0.1 or later
```
npm install ws@1.0.1
```

Technical details

A vulnerability exists in the 'ws' module before version 1.0.1 due to improper handling of numeric arguments in the ping(), pong(), and send() methods. In Node.js, passing a number to the Buffer constructor allocates a new buffer of that size without zero-filling it, leaving existing data from previous memory allocations intact. When 'ws' receives a numeric argument for these methods, it creates a buffer of that size and transmits its uninitialized contents over the network. This allows a remote attacker to trigger memory disclosure if the application logic passes untrusted input directly into these functions. The fix, implemented in version 1.0.1, ensures that numeric inputs are properly validated or converted to strings before buffer allocation.

Affected products

websockets ws < 1.0.1

Identifiers

CVE-2016-10518
GHSA-2mhh-w6q8-5hxw

Timeline

2016-01-04: patched: Version 1.0.1 released to address the buffer vulnerability.
2018-05-31: advisory: NVD published CVE-2016-10518.
2019-02-18: disclosed: GitHub Advisory GHSA-2mhh-w6q8-5hxw published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.