A vulnerability, which was classified as critical, has been found in Cryptocat up to 2.0.21. Affected by this issue is the function Math.random of the component strophe.js. The manipulation with an unknown input leads to a random values vulnerability (Random). Using CWE to declare the problem leads to CWE-330. The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Cryptocat before 2.1.12 has a strophe.js Math.random() Function Random Number Generator Weakness

The weakness was disclosed 11/04/2019 by Maxim Rupp with Cure53. This vulnerability is handled as CVE-2013-4102 since 06/12/2013. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1600.001.

Upgrading to version 2.0.22 eliminates this vulnerability.

The vulnerability is also documented in the databases at SecurityFocus (BID 61095†) and OSVDB (95006†). The entry VDB-9443 is pretty similar.

Productinfo

Name

• Cryptocat

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10
• 2.0.11
• 2.0.12
• 2.0.13
• 2.0.14
• 2.0.15
• 2.0.16
• 2.0.17
• 2.0.18
• 2.0.19
• 2.0.20
• 2.0.21

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion