PT-2019-18479 · Keybase · Keybase

0Xcccc + 4 · Published 2019-01-31 · Updated 2020-08-24 · CVE-2019-7249

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keybase versions prior to 2.12.6

Description The issue in Keybase allows one user of the system without root access to tamper with another's installs due to time-to-check-time-to-use bugs in the move RPC to the Helper.

Recommendations For versions prior to 2.12.6, update to version 2.12.6 or later to resolve the issue.

Exploit

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2019-7249

Affected Products

Keybase

References · 5

• 🔥 https://hackerone.com/reports/471739 · Exploit
• 🔥 https://keybase.io/docs/secadv/kb004 · Exploit
• https://osv.dev/vulnerability/CVE-2019-7249 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7249 · Security Note
• http://securityfocus.com/bid/106824 · Note