Executive brief
limbus-buildgen is a build tool that downloads executable resources over unencrypted HTTP connections. An attacker positioned on the network can intercept these downloads and inject a malicious executable, achieving arbitrary code execution on systems running the tool.
Technical details
The vulnerability is a missing encryption issue (CWE-311) where limbus-buildgen downloads an executable over plain HTTP without integrity verification. The attack vector requires the attacker to have a privileged network position (man-in-the-middle capability) to intercept and modify the HTTP response. This allows arbitrary code execution in the context of the user running limbus-buildgen. The vulnerability affects all versions prior to 0.1.1, which contains the fix. No authentication or user interaction is required beyond running the affected tool normally.
Affected products
- limbus-buildgen limbus-buildgen < 0.1.1
Timeline
- 2019-02-18: disclosed
- 2019-02-18: patched: Fixed in version 0.1.1