×
sorted by:
new (suggested)
besttopcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]nyanpasu64 2 points3 points  (1 child)

I've figured out what's wrong with the auto updater.

In my opinion the following fixes need to be made:

  • Replace the 301 redirect with the contents of the file?
  • Change AMDAutoUpdate.exe to follow the redirect (does not fix existing installations of the updater which can't follow the redirect)
  • Edit versioninfo.xml to not supply downloads over HTTP URLs which can be intercepted and replaced with malware!!!

The only reason AMDAutoUpdate.exe isn't already an exploit vector is because it coincidentally fails to download a file with insecure links!

[–]theclevermen 0 points1 point  (0 children)

Nice work! I wonder if supplying the redirected versioninfo URL in config would change anything. Might test that later. As for http URLs in versioninfo - they redirect to https, so WebClient would still fail at this point. It's a shame that AMD didn't fix such a trivial issue for god knows how many years now