SB2018060423 - Cryptographic issues in Kitware CMake
Published: June 4, 2018 Updated: August 8, 2020
Security Bulletin ID
SB2018060423
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Cryptographic issues (CVE-ID: CVE-2016-10642)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
cmake installs the cmake x86 linux binaries. cmake downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Remediation
Install update from vendor's website.