PT-2016-4902 · Apple · Hp Software Update

Published 2016-03-14 · Updated 2016-12-03 · CVE-2016-1731

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apple Software Update versions prior to 2.2 on Windows

Description The issue allows man-in-the-middle attackers to spoof updates by modifying the client-server data stream because it does not use HTTPS.

Recommendations For Apple Software Update versions prior to 2.2 on Windows, update to version 2.2 or later to resolve the issue.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-310

CWE-345

Related Identifiers

CVE-2016-1731

Affected Products

Hp Software Update

References · 5

• https://support.apple.com/kb/HT206091 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1731 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1731 · Security Note
• http://securitytracker.com/id/1035256 · Note
• http://securityfocus.com/bid/84283 · Note