Vulnerability Name:

CVE-2016-4055 (CCN-112574)

Assigned:2016-01-26
Published:2016-01-26
Updated:2022-06-06
Summary:The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."
CVSS v3 Severity:6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:7.8 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-400
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2016-4055

Source: CCN
Type: Node.js Web site
Node.js

Source: CCN
Type: oss-sec Mailing List, Wed, 20 Apr 2016 17:16:24 -0400 (EDT)
various vulnerabilities in Node.js packages

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20160420 various vulnerabilities in Node.js packages

Source: CCN
Type: Oracle CPUJul2018
Oracle Critical Patch Update Advisory - July 2018

Source: CONFIRM
Type: Patch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: BID
Type: Third Party Advisory, VDB Entry
95849

Source: CCN
Type: BID-95849
Moment.js CVE-2016-4055 Remote Denial of Service Vulnerability

Source: XF
Type: UNKNOWN
nodejs-cve20164055-dos(112574)

Source: MLIST
Type: Mailing List, Third Party Advisory
[flink-dev] 20190811 Apache flink 1.7.2 security issues

Source: MLIST
Type: Mailing List, Third Party Advisory
[flink-user] 20190813 Apache flink 1.7.2 security issues

Source: MLIST
Type: Mailing List, Third Party Advisory
[flink-user] 20190813 Re: Apache flink 1.7.2 security issues

Source: MLIST
Type: Mailing List, Third Party Advisory
[flink-user] 20190811 Apache flink 1.7.2 security issues

Source: CCN
Type: Node Security Web site
Regular Expression Denial of Service

Source: CONFIRM
Type: Broken Link, Exploit, Vendor Advisory
https://nodesecurity.io/advisories/55

Source: CCN
Type: IBM Security Bulletin 6444037 (Guardium Data Encryption)
Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE) (CVE-2017-18214, CVE-2016-4055, CVE-2021-20413)

Source: CCN
Type: IBM Security Bulletin 6468579 (InfoSphere Information Server)
IBM InfoSphere Information Server is vulnerable to a denial of service vulnerability in Angular.js

Source: CCN
Type: IBM Security Bulletin 6606205 (Tivoli Netcool Manager)
There are multiple security vulnerabilities in Apache Storm used by IBM Tivoli Netcool Manager.

Source: CCN
Type: IBM Security Bulletin 6615289 (Planning Analytics Workspace)
IBM Planning Analytics Workspace is affected by multiple vulnerabilities (CVE-2022-22968, CVE-2022-24785, CVE-2017-18214, CVE-2016-4055, CVE-2018-1000613, CVE-2020-15522, CVE-2018-1000180, CVE-2020-26939, CVE-2022-22314)

Source: CONFIRM
Type: Patch, Third Party Advisory
https://www.tenable.com/security/tns-2019-02

Vulnerable Configuration:Configuration 1:
  • cpe:/a:momentjs:moment:*:*:*:*:*:node.js:*:* (Version < 2.11.2)

    • Configuration 2:
  • cpe:/a:tenable:nessus:*:*:*:*:*:*:*:* (Version <= 8.2.3)

    • Configuration 3:
  • cpe:/a:oracle:primavera_unifier:*:*:*:*:*:*:*:* (Version >= 16.0 and <= 18.8.4)

    • Configuration CCN 1:
  • cpe:/a:nodejs:node.js:*:*:*:*:-:*:*:*
  • OR cpe:/a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:guardium_data_encryption:3.0.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:guardium_data_encryption:4.0.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:guardium_data_encryption:4.0.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:guardium_data_encryption:4.0.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:planning_analytics_workspace:2.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.ubuntu.disco:def:201640550000000
    V
    		CVE-2016-4055 on Ubuntu 19.04 (disco) - medium.
    2017-01-23
    oval:com.ubuntu.artful:def:20164055000
    V
    		CVE-2016-4055 on Ubuntu 17.10 (artful) - medium.
    2017-01-23
    oval:com.ubuntu.cosmic:def:201640550000000
    V
    		CVE-2016-4055 on Ubuntu 18.10 (cosmic) - medium.
    2017-01-23
    oval:com.ubuntu.bionic:def:20164055000
    V
    		CVE-2016-4055 on Ubuntu 18.04 LTS (bionic) - medium.
    2017-01-23
    oval:com.ubuntu.bionic:def:201640550000000
    V
    		CVE-2016-4055 on Ubuntu 18.04 LTS (bionic) - medium.
    2017-01-23
    oval:com.ubuntu.cosmic:def:20164055000
    V
    		CVE-2016-4055 on Ubuntu 18.10 (cosmic) - medium.
    2017-01-23
    oval:com.ubuntu.xenial:def:201640550000000
    V
    		CVE-2016-4055 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-01-23
    oval:com.ubuntu.xenial:def:20164055000
    V
    		CVE-2016-4055 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-01-23
    BACK
    momentjs moment *
    tenable nessus *
    oracle primavera unifier *
    nodejs node.js *
    ibm infosphere information server 11.7
    ibm guardium data encryption 3.0.0.2
    ibm guardium data encryption 4.0.0.0
    ibm guardium data encryption 4.0.0.3
    ibm guardium data encryption 4.0.0.4
    ibm planning analytics workspace 2.0