PT-2017-11767 · Heinekingmedia · Stashcat

Karsten König · Publicado 2017-08-01 · Atualizado 2017-08-07 · CVE-2017-11133

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions heinekingmedia StashCat versions 1.7.5 and earlier for Android heinekingmedia StashCat versions 0.0.80w and earlier for Web heinekingmedia StashCat versions 0.0.86 and earlier for Desktop

Description An issue was discovered in the encryption process of heinekingmedia StashCat. The software uses AES in CBC mode to encrypt messages with a pseudo-random secret. However, the secret and the IV are generated using methods that are not cryptographically strong, specifically math.random() in previous versions and CryptoJS.lib.WordArray.random() in newer versions, which internally uses math.random().

Recommendations For heinekingmedia StashCat versions 1.7.5 and earlier for Android, consider updating to a version that uses a cryptographically strong method for generating secrets and IVs. For heinekingmedia StashCat versions 0.0.80w and earlier for Web, consider updating to a version that uses a cryptographically strong method for generating secrets and IVs. For heinekingmedia StashCat versions 0.0.86 and earlier for Desktop, consider updating to a version that uses a cryptographically strong method for generating secrets and IVs.

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-327

Identificadores relacionados

CVE-2017-11133

Produtos afetados

Stashcat

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-11133 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2017/Jul/90 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-11133 · Nota de Segurança