PT-2007-1647 · Securekit · Securekit Steganography

Published 2007-01-10 · Updated 2018-10-16 · CVE-2007-0163

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions SecureKit Steganography versions 1.7.1 through 1.8

Description The issue allows remote attackers to bypass authentication requirements and decrypt embedded steganography by replacing the last 20 bytes of the JPEG image with alternate password information. This is due to the embedding of password information in the carrier file.

Recommendations For SecureKit Steganography versions 1.7.1 through 1.8, as a temporary workaround, consider restricting access to sensitive JPEG images until a patch is available. Avoid using the affected versions for encrypting sensitive information until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-0163

Affected Products

Securekit Steganography

References · 7

• 🔥 http://homepage.mac.com/adonismac/Advisory/steg/steganography.html · Exploit
• http://secunia.com/advisories/23639 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0163 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31378 · Note
• http://securityfocus.com/archive/1/456283/100/0/threaded · Note
• http://securityfocus.com/archive/1/456519/100/0/threaded · Note
• http://osvdb.org/31244 · Note