Is the SourceTree Mac app susceptible to the recently exposed Sparkle vulnerability?

[Ken Taylor]

I was surprised to not find any reference to this issue on the support site.

[Seth · Accepted solution]

I was browsing other questions to find the ID of an Atlassian staff member, and found this question: https://answers.atlassian.com/questions/36117100

Which referenced this bug: https://jira.atlassian.com/browse/SRCTREE-3379

[Ken Taylor]

That does address the issue and the fix has been included in version 2.2 released today.

[sachinhallad]

I upgraded to latest version 2.2. But still I am seeing that http protocol is being used for the AppCast xml .So I believe its still susceptable to MIMA.

[Der Lun]

HTTP protocol works the same irregardless of which operating system you are using so short answer is yes you are vulnerable to man in the middle attack until you have upgraded to the fixed version that does not contain this vulnerability.

[Ken Taylor]

I haven't looked into why that command doesn't pick it up but SourceTree looks to me to be using it. I have the latest version (2.1) installed and the value of CFBundleShortVersionString in the following file is 1.8.0:

/Applications/SourceTree.app/Contents/Frameworks/Sparkle.framework/

Versions/A/Resources/Autoupdate.app/Contents/Info.plist

[Seth]

I found this in a comment online: http://arstechnica.com/security/2016/02/huge-number-of-mac-apps-vulnerable-to-hijacking-and-a-fix-is-elusive/

Here's how to list all apps that use Sparkle on your system, and what version they are using:

find /Applications -path '*Autoupdate.app/Contents/Info.plist' -exec echo {} \; -exec grep -A1 CFBundleShortVersionString '{}' \; | grep -v CFBundleShortVersionString

You're looking for versions prior to 1.13.1 (as per https://github.com/sparkle-project/Sparkle/releases). These are vulnerable if they are set to load any assets over unsecured HTTP. Perhaps someone else can chine in on where those URLs can be found.

IF SourceTree doesn't use Sparkle, I'm not sure why they'd be expected to comment about it. To be fair, I don't use a Mac, so I can't check this myself. Maybe they do use Sparkle and should be more on top of the issue, idk.