PT-2017-12912 · Akeo Consulting · Rufus

Wdormann · Publicado 2017-10-18 · Atualizado 2019-10-09 · CVE-2017-13083

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Akeo Consulting Rufus versions prior to 2.17.1187

Description The issue concerns inadequate validation of the integrity of updates downloaded over HTTP, allowing an attacker to convince a user to execute arbitrary code.

Recommendations For versions prior to 2.17.1187, update to version 2.17.1187 or later to resolve the issue.

Correção

Insufficient Verification of Data Authenticity

Improper Verification of Cryptographic Signature

Improper Certificate Validation

Enumeração de Fraquezas

CWE-345

CWE-494

CWE-347

CWE-295

Identificadores relacionados

CVE-2017-13083

Produtos afetados

Rufus

Referências · 6

• https://github.com/pbatard/rufus/issues/1009 · Nota
• https://github.com/pbatard/rufus/commit/c3c39f7f8a11f612c4ebf7affce25ec6928eb1cb · Nota
• http://securityfocus.com/bid/100516 · Nota
• https://osv.dev/vulnerability/CVE-2017-13083 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/403768 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-13083 · Nota de Segurança