PT-2017-12912 · Akeo Consulting · Rufus

Wdormann · Published 2017-10-18 · Updated 2019-10-09 · CVE-2017-13083

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Akeo Consulting Rufus versions prior to 2.17.1187

Description The issue concerns inadequate validation of the integrity of updates downloaded over HTTP, allowing an attacker to convince a user to execute arbitrary code.

Recommendations For versions prior to 2.17.1187, update to version 2.17.1187 or later to resolve the issue.

Fix

Insufficient Verification of Data Authenticity

Improper Verification of Cryptographic Signature

Improper Certificate Validation

Weakness Enumeration

CWE-345

CWE-494

CWE-347

CWE-295

Related Identifiers

CVE-2017-13083

Affected Products

Rufus

References · 6

• https://osv.dev/vulnerability/CVE-2017-13083 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-13083 · Security Note
• https://github.com/pbatard/rufus/issues/1009 · Note
• https://github.com/pbatard/rufus/commit/c3c39f7f8a11f612c4ebf7affce25ec6928eb1cb · Note
• http://securityfocus.com/bid/100516 · Note
• http://kb.cert.org/vuls/id/403768 · Note