PT-2008-4838 · Linkedin · Linkedin Browser Toolbar

Publicado 2008-08-01 · Atualizado 2008-09-05 · CVE-2008-3435

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LinkedIn Browser Toolbar versions 3.0.3.1100 and earlier

Description The issue allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update. This can be achieved through techniques such as evilgrade and DNS cache poisoning, which exploit the lack of proper verification of update authenticity.

Recommendations For versions 3.0.3.1100 and earlier, update to a version that properly verifies the authenticity of updates to prevent man-in-the-middle attacks.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-3435

Produtos afetados

Linkedin Browser Toolbar

Referências · 4

• http://infobyte.com.ar/down/isr-evilgrade-1.0.0.tar.gz · Nota
• http://infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3435 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.html · Nota