CVE-2008-3433

SpeedBit Download Accelerator Plus (DAP) before 8.6.3.9 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:speedbit:download_accelerator_plus:*:*:*:*:*:*:*:*
cpe:2.3:a:speedbit:download_accelerator_plus:8.0:*:*:*:*:*:*:*
cpe:2.3:a:speedbit:download_accelerator_plus:8.1:*:*:*:*:*:*:*
cpe:2.3:a:speedbit:download_accelerator_plus:8.5:*:*:*:*:*:*:*

History

21 Nov 2024, 00:49

Type Values Removed Values Added
References () http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.html - () http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.html -
References () http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdf - () http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdf -
References () http://www.infobyte.com.ar/down/isr-evilgrade-1.0.0.tar.gz - Patch () http://www.infobyte.com.ar/down/isr-evilgrade-1.0.0.tar.gz - Patch

Information

Published : 2008-08-01 14:41

Updated : 2024-11-21 00:49


NVD link : CVE-2008-3433

Mitre link : CVE-2008-3433

CVE.ORG link : CVE-2008-3433


JSON object : View

Products Affected

speedbit

  • download_accelerator_plus
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')