Vulnerability CVE-2015-4674
Published: 2015-08-06   Modified: 2015-08-07

Description:
The autoupdate implementation in TimeDoctor Pro 1.4.72.3 on Windows relies on unsigned installer files that are retrieved without use of SSL, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
TimeDoctor Pro 1.4.72.3 Insecure Transport
Fernando Munoz
01.07.2015

Type:

CWE-345

 (Insufficient Verification of Data Authenticity)

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9.3/10
10/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Timedoctor -> Timedoctor 

 References:
http://seclists.org/fulldisclosure/2015/Jun/105
http://www.securityfocus.com/archive/1/535881/100/700/threaded
http://www.securityfocus.com/bid/75572
Copyright 2024, cxsecurity.com

 

Back to Top