PT-2017-17086 · F Secure · F-Secure Software Updater

Published 2017-03-11 · Updated 2017-03-14 · CVE-2017-6466

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions F-Secure Software Updater version 2.20

Description The issue allows man-in-the-middle attackers to replace downloaded files with their own executable, which will be executed under the SYSTEM account. This is because the software downloads installation packages over plain http and does not perform file integrity validation after download. In automatic mode, the software checks for digital signatures by default but does not verify the author of the signature. In manual mode, no signature check is performed.

Recommendations For F-Secure Software Updater version 2.20, consider disabling the automatic installation of updates and manually verify the digital signature and its author before installing any updates. As a temporary workaround, restrict the use of the Software Updater until a secure version is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-6466

Affected Products

F-Secure Software Updater

References · 4

• https://osv.dev/vulnerability/CVE-2017-6466 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6466 · Security Note
• http://seclists.org/fulldisclosure/2017/Mar/28 · Note
• http://securityfocus.com/bid/96784 · Note