PT-2017-17086 · F Secure · F-Secure Software Updater

Publicado 2017-03-11 · Atualizado 2017-03-14 · CVE-2017-6466

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions F-Secure Software Updater version 2.20

Description The issue allows man-in-the-middle attackers to replace downloaded files with their own executable, which will be executed under the SYSTEM account. This is because the software downloads installation packages over plain http and does not perform file integrity validation after download. In automatic mode, the software checks for digital signatures by default but does not verify the author of the signature. In manual mode, no signature check is performed.

Recommendations For F-Secure Software Updater version 2.20, consider disabling the automatic installation of updates and manually verify the digital signature and its author before installing any updates. As a temporary workaround, restrict the use of the Software Updater until a secure version is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-6466

Produtos afetados

F-Secure Software Updater

Referências · 4

• http://seclists.org/fulldisclosure/2017/Mar/28 · Nota
• http://securityfocus.com/bid/96784 · Nota
• https://osv.dev/vulnerability/CVE-2017-6466 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6466 · Nota de Segurança