Is CVE-2016-4055 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-4055 being exploited in the wild.

How severe is CVE-2016-4055?

Medium severity, with a CVSS score of 6.5, published 23 January 2017.

Which products and versions are affected?

moment (npm) SEMVER:introduced=0,fixed=2.11.2.

Is there a fix for CVE-2016-4055?

Yes. moment (npm): upgrade to 2.11.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-4055 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-4055?

Check whether you run Momentjs Moment, moment (npm), Oracle Primavera Unifier or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-4055: Moment.js ReDoS in duration function

CVE-2016-4055 · Severity: medium · CVSS 6.5 · Published 2017-01-23

The Moment.js library, a popular tool for parsing and formatting dates in Node.js applications, is vulnerable to a denial-of-service attack. By providing a specially crafted long string to the library's duration function, an attacker can cause the application to consume excessive CPU resources. This can lead to the application becoming unresponsive, potentially disrupting business operations and service availability.

Technologies: Momentjs Moment, moment (npm), Oracle Primavera Unifier, Tenable Nessus. Vendors: Momentjs, npm, Oracle, Tenable.

Quick answers

Is CVE-2016-4055 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-4055 being exploited in the wild.
How severe is CVE-2016-4055?: Medium severity, with a CVSS score of 6.5, published 23 January 2017.
Which products and versions are affected?: moment (npm) SEMVER:introduced=0,fixed=2.11.2.
Is there a fix for CVE-2016-4055?: Yes. moment (npm): upgrade to 2.11.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-4055 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-4055?: Check whether you run Momentjs Moment, moment (npm), Oracle Primavera Unifier or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

moment (npm): upgrade to 2.11.2 or later
```
npm install moment@2.11.2
```

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the duration function of the Moment.js library prior to version 2.11.2. The root cause is an inefficient regular expression used to parse duration strings, which exhibits polynomial or exponential backtracking when processing specifically crafted long input strings. A remote attacker can exploit this by submitting a malicious string to any application endpoint that passes user input to the affected function. Successful exploitation results in high CPU utilization, blocking the Node.js event loop and causing a denial of service. The issue is resolved in version 2.11.2.

Affected products

Moment.js project moment < 2.11.2

Identifiers

CVE-2016-4055
GHSA-87vv-r9j6-g5qv

Timeline

2016-04-20: disclosed: Vulnerability disclosed via OSS-security mailing list
2017-01-23: advisory: NVD advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.