CVE-2008-3323

setup.exe before 2.573.2.3 in Cygwin does not properly verify the authenticity of packages, which allows remote Cygwin mirror servers or man-in-the-middle attackers to execute arbitrary code via a package list containing the MD5 checksum of a Trojan horse package.

Date published : 2008-07-28

http://www.securityfocus.com/bid/30375

http://www.securityfocus.com/archive/1/494756/100/0/threaded