Description
The autoupdate implementation in TimeDoctor Pro 1.4.72.3 on Windows relies on unsigned installer files that are retrieved without use of SSL, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file.
References
- 20150629 CVE-2015-4674 - TimeDoctor autoupdate over plain-HTTP mailing-list
- 75572 vdb-entry
- 20150629 CVE-2015-4674 - TimeDoctor autoupdate over plain-HTTP mailing-list