Akeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of updates downloaded over HTTP, allowing an attacker to easily convince a user to execute arbitrary code
Weakness
The product does not validate, or incorrectly validates, a certificate.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Rufus | Rufus_project | * | 2.17 (including) |
Potential Mitigations
Related Attack Patterns
References
- http://www.kb.cert.org/vuls/id/403768
- http://www.securityfocus.com/bid/100516
- https://github.com/pbatard/rufus/commit/c3c39f7f8a11f612c4ebf7affce25ec6928eb1cb
- https://github.com/pbatard/rufus/issues/1009
- http://www.kb.cert.org/vuls/id/403768
- http://www.securityfocus.com/bid/100516
- https://github.com/pbatard/rufus/commit/c3c39f7f8a11f612c4ebf7affce25ec6928eb1cb
- https://github.com/pbatard/rufus/issues/1009