Altera Quartus Prime Pro Installer Insecure Temporary File Vulnerability

A vulnerability allowing the use of predictable file names in temporary files has been identified in the Altera Quartus Prime Pro Installer (SFX) for Windows. This issue affects versions 24.1 prior to 25.1.1 and can lead to a binary planting attack, where an attacker could potentially manipulate the installation process by placing malicious files in predictable locations.

Impact

Exploitation of this vulnerability could allow for a binary planting attack, where an attacker could place a malicious executable in a location that the installer would later execute, potentially leading to unauthorized code execution.

Remediation

Users are advised to upgrade to the Quartus 25.3 Pro Edition installer or later. For those using older versions of Quartus Prime Pro, downloading the individual installation files directly from the Altera download page will avoid this issue, as these files are not affected by the vulnerability.