Security Bulletin: Node.js Package Manager (npm) Bearer Token Vulnerability affects IBM Rational Application Developer for WebSphere Software (CVE-2016-3956)

Security Bulletin

Summary

A vulnerability in the Node Package Manager's use of HTTP bearer tokens affects IBM SDK for Node.js.

Vulnerability Details

CVEID: CVE-2016-3956

DESCRIPTION: npm could allow a remote attacker to obtain sensitive information, caused by the unintentional leakage of bearer tokens from the command-line interface. By setting up an HTTP server and collecting token information, an attacker could exploit this vulnerability to impersonate the user and do anything the owner of the information could, including publishing new versions of packages.

CVSS Base Score: 9.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112153 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Affected Products and Versions

IBM Rational Application Developer for WebSphere Software v9.1 and v9.5

Remediation/Fixes

Rational Application Developer	9.1.x and 9.5.x	PI60886	Apply IBM SDK for Node.js Version 1.1 release updated equivalent to the Joyent Node.js API version 0.10.44 to the Cordova platform in the product. Installation instructions for applying the update to the Cordova platform in the product can be found here: Upgrading the IBM SDK for Node.js used by Cordova

Get Notified about Future Security Bulletins

Subscribe to My Notifications to be notified of important product support alerts like this.

References

Complete CVSS v2 Guide
On-line Calculator v2

Complete CVSS v3 Guide
On-line Calculator v3

Off

Change History

29 April 2016: Original copy published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{"Product":{"code":"SSRTLW","label":"Rational Application Developer for WebSphere Software"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Cordova","Platform":[{"code":"PF016","label":"Linux"},{"code":"PF022","label":"OS X"},{"code":"PF033","label":"Windows"}],"Version":"9.1;9.1.0.1;9.1.1;9.1.1.1;9.1.1.2;9.5;9.5.0.1;9.5.0.2","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]

Tips

Security Bulletin: Node.js Package Manager (npm) Bearer Token Vulnerability affects IBM Rational Application Developer for WebSphere Software (CVE-2016-3956)