TimeDoctor claims to be a software that helps to improve the productivity of teams, reduce time spent on distractions [1] Vulnerability: TimeDoctor autoupdate feature downloads and executes files over plain HTTP and doesn't perform any check with the files. An attacker with MITM capabilities (i.e., when user connects to a public wifi) could override the Timedoctor subdomain and then execute custom binaries on the machine where the application is running. The update mechanisms first downloads update.xml [2] which has the version number, url and a filename for the new installer. Credit: Fernando Muñoz CVE: CVE-2015-4674 Version tested: TimeDoctor Pro 1.4.72.3 for Windows Other editions/versions maybe affected. Demo video: https://www.youtube.com/watch?v=t1JM4DaR130 Vendor acknowledged the issue on Jun 18 and a new version should be available today (Jun 29). [1] https://www.timedoctor.com/about-us.html [2] http://updates.timedoctor.com/download/_production/tdpro/windows/update.xml
