CVE-2017-13083

Akeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of updates downloaded over HTTP, allowing an attacker to easily convince a user to execute arbitrary code

Score

CVSS 3.0 8.1 High

Status

Modified - cret@cert.org

Published

2017-10-18

Last modified

2024-08-05

Weaknesses

CWE-295, CWE-345, CWE-347, CWE-494

Affected products

• Rufus (Akeo)
• Rufus (Akeo Consulting)

References

• http://www.kb.cert.org/vuls/id/403768
• http://www.securityfocus.com/bid/100516
• https://github.com/pbatard/rufus/commit/c3c39f7f8a11f612c4ebf7affce25ec6928eb1cb
• https://github.com/pbatard/rufus/issues/1009