Sparkle vulnerability

[kevin1]

Hi Cody,

gfxCardStatus doesn't load its updates over HTTPS, making it likely affected by the recent Sparkle vulnerability. Specifically, a MITM attacker can execute arbitrary remote code when the SUFeedURL isn’t loaded over HTTPS:

http://gfx.io/appcast.xml

More information about the vulnerability:

https://vulnsec.com/2016/osx-apps-vulnerabilities/
https://www.evilsocket.net/2016/01/30/osx-mass-pwning-using-bettercap-and-the-sparkle-updater-vulnerability/

Thanks! Hope to see it updated soon,
Kevin

[codykrieger]

Fixed in #225. I'll leave this open until a new version has been released with the fix.

[zachriggle]

All users are still vulnerable to this, since the latest version is still v2.3, released back in 2012.

Would you mind cutting a new release, which either:

1. Disables Sparkle update entirely
2. Uses the fix from Switched to HTTPS due to Sparkle Security vulnerability #225

Thanks!

[mgol]

This seems to be a big vulnerability which may lead to arbitrary code execution... :/ Could we get a release?

[mgol]

Ping @codykrieger, could we have a release?

[codykrieger]

Finally (!) putting out a beta release that fixes this and includes some Big Sur fixes (#336).

[codykrieger]

Alright—fixed in v2.5b1: https://gfx.io/downloads/gfxCardStatus-2.5b1.zip