CVE-2008-3433

SpeedBit Download Accelerator Plus (DAP) before 8.6.3.9 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:speedbit:download_accelerator_plus:*:*:*:*:*:*:*:*
cpe:2.3:a:speedbit:download_accelerator_plus:8.0:*:*:*:*:*:*:*
cpe:2.3:a:speedbit:download_accelerator_plus:8.1:*:*:*:*:*:*:*
cpe:2.3:a:speedbit:download_accelerator_plus:8.5:*:*:*:*:*:*:*

History

No history.

Information

Published : 2008-08-01 14:41

Updated : 2024-02-28 11:21


NVD link : CVE-2008-3433

Mitre link : CVE-2008-3433

CVE.ORG link : CVE-2008-3433


JSON object : View

Products Affected

speedbit

  • download_accelerator_plus
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')