JVN#36623716: Music Center for PC improperly verifies software update files

Music Center for PC provided by Sony Video & Sound Products Inc. contains an issue in software update process (CWE-669). As a result, under a man-in-the-middle attack, a specially crafted executable file may be downloaded and executed.

Impact

Under a man-in-the-middle attack, a specially crafted file may be downloaded and executed.

Solution

Update the Software
Update to the latest version using the latest installer directly downloaded from the developer’s site, according to the information provided by the developer.

Products Affected

• Music Center for PC version 1.0.02 and earlier