bugtraq - CVE-2015-4674 - TimeDoctor autoupdate over plain-HTTP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 29 Jun 2015 18:49:20 -0500
From: Fernando Muñoz <fernando@...l-life.com>
To: undisclosed-recipients: ;
Subject: CVE-2015-4674 - TimeDoctor autoupdate over plain-HTTP

TimeDoctor claims to be a software that helps to improve the
productivity of teams, reduce time spent on distractions [1]

Vulnerability:
TimeDoctor autoupdate feature downloads and executes files over plain
HTTP and doesn't perform any check with the files. An attacker with
MITM capabilities (i.e., when user connects to a public wifi) could
override the Timedoctor subdomain and then execute custom binaries on
the machine where the application is running.

The update mechanisms first downloads update.xml [2] which has
the version number, url and a filename for the new
installer.

Credit:
Fernando Muñoz

CVE:
CVE-2015-4674

Version tested:
TimeDoctor Pro 1.4.72.3 for Windows
Other editions/versions maybe affected.

Demo video:
https://www.youtube.com/watch?v=t1JM4DaR130

Vendor acknowledged the issue on Jun 18 and a new version should be
available today (Jun 29).

[1] https://www.timedoctor.com/about-us.html
[2] http://updates.timedoctor.com/download/_production/tdpro/windows/update.xml