TimeDoctor claims to be a software that helps to improve the productivity of teams, reduce time spent on distractions [1] Vulnerability: TimeDoctor autoupdate feature downloads and executes files over plain HTTP and doesn't perform any check with the files. An attacker with MITM capabilities (i.e., when user connects to a public wifi) could override the Timedoctor subdomain and then execute custom binaries on the machine where the application is running. The update mechanisms first downloads update.xml [2] which has the version number, url and a filename for the new installer. Credit: Fernando Muñoz CVE: CVE-2015-4674 Version tested: TimeDoctor Pro 1.4.72.3 for Windows Other editions/versions maybe affected. Demo video: https://www.youtube.com/watch?v=t1JM4DaR130 Vendor acknowledged the issue on Jun 18 and a new version should be available today (Jun 29). [1] http://ift.tt/1NsEGe0 [2] http://ift.tt/1R2ihJT
Source: Gmail -> IFTTT-> Blogger
No comments:
Post a Comment