A recently disclosed security vulnerability in the popular KeePass 2 application affects all versions of the password manager, but only if automatic software updates are enabled.
KeePass 2 has the ability to periodically check for program updates. Although checks for new updates are performed continuously, if the feature is enabled, automatic download and installation of updates is not supported.
Let's see what happens: The KeePass application contacts a service to check if an update is available. Users can then click to view the updated version, and if an update is available, it will open a page on the Internet with the file for download.
The vulnerability exploits the fact that KeePass 2 distributes updates over HTTP rather than HTTPS. An attacker could exploit this by intercepting update requests, for example on a local network, sending false update information to the KeePass 2 client, to trick users into visiting a web page where a malicious version of KeePass is available for download.
The KeePass developer will not fix the problem, according to the report.
How to protect yourself:
Those of you who use the KeePass application have an option to disable checks for updates.
Open the KeePass 2 software on your system.
Select Tools > Options from the menu.
On the Advanced tab in the options window, remove the check mark from “Check for KeePass updates at startup.”
The downside is that you will have to find a way to stay informed about new updates. You can visit the application's website for this, or subscribe to the KeePass RSS Feed if you use an RSS reader.
