CVE-2013-3667

Опубликовано: 31 дек. 2013

Источник: nvd

CVSS2: 6.4

EPSS Низкий

Описание

The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit before 10.5.5 does not properly download and verify updates before installation, which allows attackers to perform "tampering or corruption" of the updates.

Ссылки

http://www.barebones.com/support/bbedit/arch_bbedit1055.html
Vendor Advisory
http://www.barebones.com/support/textwrangler/notes_tw453.html
Vendor Advisory
http://www.barebones.com/support/yojimbo/arch_yojimbo40.html
Vendor Advisory
https://groups.google.com/forum/#%21msg/bbedit/BjvyUKCM4Gk/ZT_v03QqPqgJ
http://www.barebones.com/support/bbedit/arch_bbedit1055.html
Vendor Advisory
http://www.barebones.com/support/textwrangler/notes_tw453.html
Vendor Advisory
http://www.barebones.com/support/yojimbo/arch_yojimbo40.html
Vendor Advisory
https://groups.google.com/forum/#%21msg/bbedit/BjvyUKCM4Gk/ZT_v03QqPqgJ

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:barebones:textwrangler:*:*:*:*:*:*:*:*

Версия до 4.5.2 (включая)

cpe:2.3:a:barebones:textwrangler:2.3:*:*:*:*:*:*:*

cpe:2.3:a:barebones:textwrangler:3.0:*:*:*:*:*:*:*

cpe:2.3:a:barebones:textwrangler:3.1:*:*:*:*:*:*:*

cpe:2.3:a:barebones:textwrangler:3.5:*:*:*:*:*:*:*

cpe:2.3:a:barebones:textwrangler:3.5.1:*:*:*:*:*:*:*

cpe:2.3:a:barebones:textwrangler:3.5.3:*:*:*:*:*:*:*

cpe:2.3:a:barebones:textwrangler:4.0:*:*:*:*:*:*:*

cpe:2.3:a:barebones:textwrangler:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:barebones:textwrangler:4.5:*:*:*:*:*:*:*

cpe:2.3:a:barebones:textwrangler:4.5.1:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:barebones:bbedit:*:*:*:*:*:*:*:*

Версия до 10.5.4 (включая)

cpe:2.3:a:barebones:bbedit:10.0:*:*:*:*:*:*:*

cpe:2.3:a:barebones:bbedit:10.0.1:*:*:*:*:*:*:*

cpe:2.3:a:barebones:bbedit:10.1:*:*:*:*:*:*:*

cpe:2.3:a:barebones:bbedit:10.1.1:*:*:*:*:*:*:*

cpe:2.3:a:barebones:bbedit:10.1.2:*:*:*:*:*:*:*

cpe:2.3:a:barebones:bbedit:10.5:*:*:*:*:*:*:*

cpe:2.3:a:barebones:bbedit:10.5.1:*:*:*:*:*:*:*

cpe:2.3:a:barebones:bbedit:10.5.2:*:*:*:*:*:*:*

cpe:2.3:a:barebones:bbedit:10.5.3:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:barebones:yojimbo:*:*:*:*:*:*:*:*

Версия до 3.0.4 (включая)

cpe:2.3:a:barebones:yojimbo:1.4:*:*:*:*:*:*:*

cpe:2.3:a:barebones:yojimbo:1.4.1:*:*:*:*:*:*:*

cpe:2.3:a:barebones:yojimbo:1.4.2:*:*:*:*:*:*:*

cpe:2.3:a:barebones:yojimbo:1.5:*:*:*:*:*:*:*

cpe:2.3:a:barebones:yojimbo:1.5.1:*:*:*:*:*:*:*

cpe:2.3:a:barebones:yojimbo:1.5.2:*:*:*:*:*:*:*

cpe:2.3:a:barebones:yojimbo:2.0:*:*:*:*:*:*:*

cpe:2.3:a:barebones:yojimbo:2.1:*:*:*:*:*:*:*

cpe:2.3:a:barebones:yojimbo:2.2:*:*:*:*:*:*:*

cpe:2.3:a:barebones:yojimbo:3.0:*:*:*:*:*:*:*

cpe:2.3:a:barebones:yojimbo:3.0.1:*:*:*:*:*:*:*

cpe:2.3:a:barebones:yojimbo:3.0.2:*:*:*:*:*:*:*

cpe:2.3:a:barebones:yojimbo:3.0.3:*:*:*:*:*:*:*

EPSS

Процентиль: 63%

0.00452

Низкий

6.4 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

GHSA-qcrp-3q6q-67w2

github

больше 3 лет назад

EPSS

Процентиль: 63%

0.00452

Низкий

6.4 Medium

CVSS2

Дефекты

CWE-20