PT-2017-11765 · Heinekingmedia · Stashcat

Karsten König · Published 2017-08-01 · Updated 2019-10-03 · CVE-2017-11131

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions heinekingmedia StashCat versions 1.7.5 and earlier for Android heinekingmedia StashCat versions 0.0.80w and earlier for Web heinekingmedia StashCat versions 0.0.86 and earlier for Desktop

Description The issue concerns the authentication mechanism, where user passwords are hashed directly with SHA-512 without a salt or another key-derivation mechanism. Only the first 32 bytes of the hash are used, making it vulnerable to dictionary and rainbow-table attacks if an attacker gains access to the password hash.

Recommendations For heinekingmedia StashCat version 1.7.5 and earlier for Android, consider implementing a secure password hashing mechanism that utilizes a salt and a key-derivation function to prevent easy dictionary and rainbow-table attacks. For heinekingmedia StashCat version 0.0.80w and earlier for Web, consider implementing a secure password hashing mechanism that utilizes a salt and a key-derivation function to prevent easy dictionary and rainbow-table attacks. For heinekingmedia StashCat version 0.0.86 and earlier for Desktop, consider implementing a secure password hashing mechanism that utilizes a salt and a key-derivation function to prevent easy dictionary and rainbow-table attacks.

Fix

Weakness Enumeration

CWE-916

Related Identifiers

CVE-2017-11131

Affected Products

Stashcat

References · 3

• https://osv.dev/vulnerability/CVE-2017-11131 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11131 · Security Note
• http://seclists.org/fulldisclosure/2017/Jul/90 · Note