Researchers have quietly shut down a critical vulnerability in the abandoned Time4Popcorn app, a fork of the popular Popcorn Time BitTorrent client. The flaw, located in the app’s updater, could have let attackers execute malicious code with elevated privileges on millions of computers.
Time4Popcorn was never officially maintained, yet it continued to circulate among users who downloaded it for its streaming capabilities. The updater component, which was designed to fetch new releases, contained a remote code execution (RCE) flaw that could be triggered by a malicious update file.
According to security researchers, the vulnerability could have allowed an attacker to run arbitrary code on a victim’s machine with the same privileges as the user. In practice, this meant that a compromised update could give an attacker full control over the affected system.
To mitigate the risk, the researchers remotely disabled the vulnerable updater, effectively preventing any further malicious updates from being delivered. The fix stops the app from contacting its update server, closing the attack vector that could have been exploited on a global scale.
While the Time4Popcorn app is no longer actively developed, the incident underscores the importance of keeping even abandoned software secure, as outdated applications can still expose millions of users to serious security threats.
<small>Source: Bleeping Computer — read the original story there.</small>
