retx

Only when application was compiled on OSX 10.11 El Capitan, it's not available in previous versions.

Not affected by unsafe HTTP configuration but affected by Sparkle bug which allows to exploit it in a case when XML file on the server was replaced since it's not signed using DSA key. You can still exploit it without HTTP and MITM "features".

I know that it's hard to believe but yes, they do. It's just a one of two vulnerabilities in that case to be clear.

With this updating process when the update process itself is vulnerable is "tricky", I know but you can avoid those nasty things by:

1) Using secure and let's say trusted VPN and then all your connections are going to be encrypted by default 2) Update your applications in trusted environment like your home network

There is only one thing to remember - don’t connect to public Wi-Fi Hotspots unless you know what you do.

That's totally true but, WebView allows to execute unsafe handlers like 'file://', 'ftp://'. As a result in the worst case scenario when appcast webserver was compromised then you don't need a private DSA key (which I suppose is well protected on developers computers) to sign new binary, you can just modify XML from appcast to get remote code execution on OSX computers actually checking for an update. In short, from the website security flaw to RCE on thousands of computers, or even more, then you don't need an active MITM attack actually, think about it.

I would consider it as 2 different vulnerabilities.

List of vulnerable applications is here - https://github.com/sparkle-project/Sparkle/issues/717