CVE-2017-6466: Input Validation
F-Secure Software Updater 2.20, as distributed in several F-Secure products, downloads installation packages over plain http and does not perform file integrity validation after download. Man-in-the-middle attackers can replace the file with their own executable which will be executed under the SYSTEM account. Note that when Software Updater is configured to install updates automatically, it checks if the downloaded file is digitally signed by default, but does not check the author of the signature. When running in manual mode (default), no signature check is performed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure F-Secure Software Updater (v2.20, as distributed in F-Secure products) to download installation packages over HTTPS rather than plain HTTP to prevent man-in-the-middle replacement.
F-Secure Software Updater Installation package download protocol = Use HTTPS instead of plain HTTP - Configuration
Enable file integrity validation for downloaded installation packages in F-Secure Software Updater (v2.20) so replaced files are detected and not executed.
F-Secure Software Updater File integrity validation after download = Enabled - Configuration
When Software Updater is configured to install updates automatically, ensure it validates the signature author as well (not only that the file is digitally signed by default) to prevent execution of attacker-replaced executables.
F-Secure Software Updater Digital signature author validation = Verify signature author (not only that it is digitally signed) - Configuration
In manual mode (default) of F-Secure Software Updater (v2.20), enable signature checking so downloaded updates are validated before execution.
F-Secure Software Updater Signature check in manual mode = Enabled - Compensating control
Temporarily restrict network paths/egress used by Software Updater to trusted channels (e.g., block outbound access except to required update endpoints) to reduce the risk of man-in-the-middle attacks while remediation is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6466?
CVE-2017-6466 is rated as a high severity vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2017-6466?
To mitigate CVE-2017-6466, upgrade F-Secure Software Updater to a version that uses secure connections and verifies file integrity.
What systems are affected by CVE-2017-6466?
CVE-2017-6466 affects F-Secure Software Updater version 2.20 across several F-Secure products.
Can CVE-2017-6466 allow unauthorized software installation?
Yes, CVE-2017-6466 can allow attackers to replace legitimate installation files, potentially leading to unauthorized software execution.
Is there a risk of data compromise due to CVE-2017-6466?
Yes, exploiting CVE-2017-6466 could lead to data compromise as an attacker could execute malicious code under the system context.