Design/Logic Flaw

Apple iTunes before 10.5.1 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

Design/Logic Flaw

The GUP generic update process in Notepad++ before 4.8.1 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

Design/Logic Flaw

Nullsoft Winamp before 5.24 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

CVE-2008-3437

OpenOffice.org before 2.1.0 does not properly verify the authenticity of updates, allowing man-in-the-middle attackers to execute arbitrary code via a Trojan horse update. Affected: OOo up to 2.0.x; root cause is failing update verification. Impact: arbitrary code execution through malicious upda...

CVE-2008-3439

SpeedBit Video Acceleration before 2.2.1.8 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

CVE-2008-3441

Winamp prior to 5.24 fails to verify update authenticity, enabling MITM attackers to run arbitrary code through Trojan horse updates. The vulnerability is demonstrated by use of evilgrade and DNS cache poisoning. Affected component is the update verification process; root cause relates to insuffi...

CVE-2008-3442

WinZip before 11.0 is affected. The vulnerability arises because updates are not properly authenticated, enabling a man‑in‑the‑middle to run arbitrary code via a Trojan horse update. Demonstrations referenced include evilgrade and DNS cache poisoning. No patch/version remediation details are prov...

CVE-2008-3436

The GUP generic update process in Notepad++ before 4.8.1 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

CVE-2008-3434

Apple iTunes before 10.5.1 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

CVE-2008-3441

Nullsoft Winamp before 5.24 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

CVE-2008-3440

CVE-2008-3440 affects Sun Java 1.6.0_03 and earlier (potentially later versions) where updater authenticity is not properly verified, enabling a man-in-the-middle attacker to run arbitrary code via a Trojan horse update (as demonstrated by evilgrade and DNS cache poisoning). The connected sources...

CVE-2008-3433

SpeedBit Download Accelerator Plus DAP before 8.6.3.9 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

CVE-2008-3433

CVE-2008-3433 affects SpeedBit Download Accelerator Plus (DAP) prior to 8.6.3.9. The issue is that DAP does not properly verify update authenticity, enabling a man-in-the-middle to substitute a Trojan-horse update and allow arbitrary code execution. The vulnerability is demonstrated by references...

CVE-2008-3438

The CVE-2008-3438 entry concerns Apple Mac OS X and a vulnerability in the update mechanism. The root cause is improper verification of update authenticity, enabling a man-in-the-middle attacker to deliver a Trojan-horse update that can execute arbitrary code. The public descriptions reference th...

CVE-2008-3435

The CVE-2008-3435 issue affects the LinkedIn Browser Toolbar (version 3.0.3.1100 and earlier) where the update mechanism does not properly verify authenticity, enabling a man-in-the-middle to deliver a Trojan horse update and execute arbitrary code. Documented impact is arbitrary code execution v...

CVE-2008-3442

WinZip before 11.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

CVE-2008-3437

OpenOffice.org OOo before 2.1.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

CVE-2008-3438

Apple Mac OS X does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

Debian DSA-1623-1 : dnsmasq - DNS cache poisoning

Dan Kaminsky discovered that properties inherent to the DNS protocol lead to practical DNS cache poisoning attacks. Among other things, successful attacks can lead to misdirected web traffic and email rerouting. This update changes Debian's dnsmasq packages to implement the recommended...

[SECURITY] [DSA 1623-1] New dnsmasq packages fix cache poisoning

------------------------------------------------------------------------ Debian Security Advisory DSA-1623-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff July 31, 2008 http://www.debian.org/security/faq -...