Vulnerability-Lookup

CNVD-2017-19466

Vulnerability from cnvd - Published: 2017-08-08

Title

heinekingmedia StashCat for Android、Web和Desktop任意文件读取漏洞

Description

heinekingmedia StashCat for Android、Web和Desktop都是德国heinekingmedia公司的产品。heinekingmedia StashCat for Android是一款基于Android的企业级通讯软件。heinekingmedia StashCat for Web是基于Web的版本，heinekingmedia StashCat for Desktop是PC端版本。 heinekingmedia StashCat for Android、Web和Desktop中存在安全漏洞。攻击者可利用该漏洞读取通信。

Severity

中

Patch Name

heinekingmedia StashCat for Android、Web和Desktop任意文件读取漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，详情请关注厂商主页： https://www.stashcat.com/

Reference

http://seclists.org/fulldisclosure/2017/Jul/90

Impacted products

Name
['heinekingmedia heinekingmedia StashCat for Android <1.7.5', 'heinekingmedia heinekingmedia StashCat for Desktop <=0.0.86', 'heinekingmedia heinekingmedia StashCat for Web <=0.0.80w']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-11136",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11136"
    }
  },
  "description": "heinekingmedia StashCat for Android\u3001Web\u548cDesktop\u90fd\u662f\u5fb7\u56fdheinekingmedia\u516c\u53f8\u7684\u4ea7\u54c1\u3002heinekingmedia StashCat for Android\u662f\u4e00\u6b3e\u57fa\u4e8eAndroid\u7684\u4f01\u4e1a\u7ea7\u901a\u8baf\u8f6f\u4ef6\u3002heinekingmedia StashCat for Web\u662f\u57fa\u4e8eWeb\u7684\u7248\u672c\uff0cheinekingmedia StashCat for Desktop\u662fPC\u7aef\u7248\u672c\u3002\r\n\r\nheinekingmedia StashCat for Android\u3001Web\u548cDesktop\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8bfb\u53d6\u901a\u4fe1\u3002",
  "discovererName": "Greets to the team of CIPHRON, especially Martin, Jan and Frithjof",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttps://www.stashcat.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-19466",
  "openTime": "2017-08-08",
  "patchDescription": "heinekingmedia StashCat for Android\u3001Web\u548cDesktop\u90fd\u662f\u5fb7\u56fdheinekingmedia\u516c\u53f8\u7684\u4ea7\u54c1\u3002heinekingmedia StashCat for Android\u662f\u4e00\u6b3e\u57fa\u4e8eAndroid\u7684\u4f01\u4e1a\u7ea7\u901a\u8baf\u8f6f\u4ef6\u3002heinekingmedia StashCat for Web\u662f\u57fa\u4e8eWeb\u7684\u7248\u672c\uff0cheinekingmedia StashCat for Desktop\u662fPC\u7aef\u7248\u672c\u3002\r\n\r\nheinekingmedia StashCat for Android\u3001Web\u548cDesktop\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8bfb\u53d6\u901a\u4fe1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "heinekingmedia StashCat for Android\u3001Web\u548cDesktop\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "heinekingmedia heinekingmedia StashCat for Android \u003c1.7.5",
      "heinekingmedia heinekingmedia StashCat for Desktop \u003c=0.0.86",
      "heinekingmedia heinekingmedia StashCat for Web \u003c=0.0.80w"
    ]
  },
  "referenceLink": "http://seclists.org/fulldisclosure/2017/Jul/90",
  "serverity": "\u4e2d",
  "submitTime": "2017-08-03",
  "title": "heinekingmedia StashCat for Android\u3001Web\u548cDesktop\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6\u6f0f\u6d1e"
}

CVE-2017-11136 (GCVE-0-2017-11136)

Vulnerability from cvelistv5 – Published: 2017-08-01 14:00 – Updated: 2024-08-05 17:57

Summary

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. It uses RSA to exchange a secret for symmetric encryption of messages. However, the private RSA key is not only stored on the client but transmitted to the backend, too. Moreover, the key to decrypt the private key is composed of the first 32 bytes of the SHA-512 hash of the user password. But this hash is stored on the backend, too. Therefore, everyone with access to the backend database can read the transmitted secret for symmetric encryption, hence can read the communication.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

1 reference

URL	Tags
http://seclists.org/fulldisclosure/2017/Jul/90	x_refsource_MISC

Date Public

2017-08-01 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:57:58.103Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2017/Jul/90"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-08-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. It uses RSA to exchange a secret for symmetric encryption of messages. However, the private RSA key is not only stored on the client but transmitted to the backend, too. Moreover, the key to decrypt the private key is composed of the first 32 bytes of the SHA-512 hash of the user password. But this hash is stored on the backend, too. Therefore, everyone with access to the backend database can read the transmitted secret for symmetric encryption, hence can read the communication."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-01T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2017/Jul/90"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-11136",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. It uses RSA to exchange a secret for symmetric encryption of messages. However, the private RSA key is not only stored on the client but transmitted to the backend, too. Moreover, the key to decrypt the private key is composed of the first 32 bytes of the SHA-512 hash of the user password. But this hash is stored on the backend, too. Therefore, everyone with access to the backend database can read the transmitted secret for symmetric encryption, hence can read the communication."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://seclists.org/fulldisclosure/2017/Jul/90",
              "refsource": "MISC",
              "url": "http://seclists.org/fulldisclosure/2017/Jul/90"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-11136",
    "datePublished": "2017-08-01T14:00:00.000Z",
    "dateReserved": "2017-07-09T00:00:00.000Z",
    "dateUpdated": "2024-08-05T17:57:58.103Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-19466

CVE-2017-11136 (GCVE-0-2017-11136)

Tags

Sightings

Nomenclature