[prev in list] [next in list] [prev in thread] [next in thread]
List: full-disclosure
Subject: [FD] CVE-2015-4674 - TimeDoctor autoupdate over plain-HTTP
From: Fernando_Muñoz <fernando () null-life ! com>
Date: 2015-06-29 23:49:20
Message-ID: CAEr-gPHX7eQQGW3VUyYUs_3UehhdKurcCQEM3QgUwoiiGtmvdQ () mail ! gmail ! com
[Download RAW message or body]
TimeDoctor claims to be a software that helps to improve the
productivity of teams, reduce time spent on distractions [1]
Vulnerability:
TimeDoctor autoupdate feature downloads and executes files over plain
HTTP and doesn't perform any check with the files. An attacker with
MITM capabilities (i.e., when user connects to a public wifi) could
override the Timedoctor subdomain and then execute custom binaries on
the machine where the application is running.
The update mechanisms first downloads update.xml [2] which has
the version number, url and a filename for the new
installer.
Credit:
Fernando Muñoz
CVE:
CVE-2015-4674
Version tested:
TimeDoctor Pro 1.4.72.3 for Windows
Other editions/versions maybe affected.
Demo video:
https://www.youtube.com/watch?v=t1JM4DaR130
Vendor acknowledged the issue on Jun 18 and a new version should be
available today (Jun 29).
[1] https://www.timedoctor.com/about-us.html
[2] http://updates.timedoctor.com/download/_production/tdpro/windows/update.xml
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic