SumatraPDF update checks skip host name verification
A Windows document viewer can be fooled by fake update servers.
Summary
SumatraPDF's HTTPS update and crash-symbol requests skip host name checks, so an attacker on the network path can impersonate the update server. Versions 3.6.1 and older on Windows are affected.
Affected when
- attacker positioned on the network path
- a Windows-trusted certificate for an attacker-controlled domain
What to do
Affected are versions 3.6.1 and older. Check that you run a newer version than 3.6.1 and read the vendor's advisory. No fixed version is available yet.
Products and platforms
CVE IDs
Times
First published
First seen