Skip to main content

Critical Flaw Hits Popular Windows Apps Built With Electron JS Framework

A critical remote code execution vulnerability has been reported in Electron—a popular web application framework that powers thousands of widely-used desktop applications including Skype, Signal, Wordpress and Slack—that allows for remote code execution.

Electron is an open-source framework that is based on Node. js and Chromium Engine and allows app developers to build cross-platform native desktop applications for Windows, macOS and Linux, without knowledge of programming languages used for each platform.

The vulnerability, assigned as the number CVE-2018-1000006, affects only those apps that run on Microsoft Windows and register themselves as the default handler for a protocol like myapp://.
"Such apps can be affected regardless of how the protocol is registered, e.g. using native code, the Windows registry, or Electron's app.setAsDefaultProtocolClient API," Electron says in an advisorypublished Monday.
The Electron team has also confirmed that applications designed for Apple's macOS and Linux are not vulnerable to this issue, and neither those (including for Windows) that do not register themselves as the default handler for a protocol like myapp://.

The Electron developers have already released two new versions of their framework, i.e. 1.8.2-beta.4, 1.7.11, and 1.6.16 to address this critical vulnerability.

"If for some reason you are unable to upgrade your Electron version, you can append—as the last argument when calling app.setAsDefaultProtocolClient, which prevents Chromium from parsing further options," the company says.

End users can do nothing about this vulnerability; instead, developers using Electron JS framework have to upgrade their applications immediately to protect their user base.

Much details of the remote code execution vulnerability have not been disclosed yet, neither the advisory named any of the vulnerable apps (that make themselves the default protocol handler) for security reason.

We will update you as soon as any details about the flaw come out.
More Link:

Labels:
Location: India

Comments

Post a Comment

Popular posts from this blog

iOS 11.3 coming this spring with battery and performance settings, ARKit 1.5, new Animoji

In a sign that Apple will continue to update iOS regularly instead of withholding features for its next major point-zero release, Apple on Wednesday revealed new features coming to an iOS 11.3 update this spring, including the ability to toggle the power management feature for iPhone models with aging batteries. Apple will implement new battery health information and the ability to customize power settings after it was revealed that the company  throttles CPU performance on older devices  where the battery is deteriorating. Apple's throttling is done to prevent random shutdowns of the device and ensure smooth operation, but some customers took offense to the fact that the slowdowns were occurring without transparency to the user. In a press release issued on Wednesday, Apple said that the iOS 11.3 update this fall will show battery health, and recommend to users if their battery needs to be serviced. The capabilities will be available for iPhone 6 and later. Users will...
Post a Comment
Read more

[Guide] How to Protect Your Devices Against Meltdown and Spectre Attacks

Recently uncovered two huge processor vulnerabilities called Meltdown and Spectre have taken the whole world by storm, while vendors are rushing out to patch the vulnerabilities in its products. The issues apply to all modern processors and affect nearly all operating systems (Windows, Linux, Android, iOS, macOS, FreeBSD, and more), smartphones and other computing devices made in the past 20 years. What are Spectre and Meltdown? We have explained both, Meltdown (CVE-2017-5754) and Spectre (CVE-2017-5753, CVE-2017-5715), exploitation techniques in our previous article. In short, Spectre and Meltdown are the names of security vulnerabilities found in many processors from Intel, ARM and AMD that could allow attackers to steal your passwords, encryption keys and other private information. Both attacks abuse 'speculative execution' to access privileged memory—including those allocated for the kernel—from a low privileged user process like a malicious app running...
Post a Comment
Read more

12 Android Oreo Hidden Features You Can Try

lthough I have a special place in my heart for this mobile operating system, I won’t say I am aware of every hidden Android feature that exists. But still, people who own a device want to explore it to the fullest. The same might go for most of the users. Being an owner of a Moto device, I am apparently deprived of the Android O update. But thanks to a friend of mine who lent me his expensive Pixel, I got to have a hand on the latest dessert from Google. Android’s most recent upgrade now runs on only 1.1% of Android devices worldwide, as per the numbers released by Google in February 2018. Certainly, it is an improvement over Nougat with features like Picture-in-Picture, system-wide autofill functionality, and Notifications improvements, and additional developments like Project Trebble. But people always have the urge find what they prefer to call hidden Android features. Personally, it has been hard for me to digest the term, as most of them are a few taps awa...
Post a Comment
Read more