Sticker Unauthorized Secure Message Sending Vulnerability

Bugtraq ID:	11333
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 05 2004 12:00AM
Updated:	Oct 05 2004 12:00AM
Credit:	This vulnerability was reported by the vendor.
Vulnerable:	Matthew Phillips Sticker 3.1 .0 beta 1
Not Vulnerable:	Matthew Phillips Sticker 3.1 .0 beta 2

Sticker Unauthorized Secure Message Sending Vulnerability

It is reported that Sticker is susceptible to an unauthorized secure message sending vulnerability.

This vulnerability reportedly exists because of a flaw in the application that allows for senders to send messages to groups when they do not hold the specified, shared private key of the group. This allows unauthenticated, unauthorized users to send messages to groups.

This vulnerability is reported to exist in version 3.1 beta 1 of Sticker.

Sticker Unauthorized Secure Message Sending Vulnerability

An exploit is not required.

Sticker Unauthorized Secure Message Sending Vulnerability

Solution:
The vendor has released version 3.1.0 beta 2 to address this issue:


Matthew Phillips Sticker 3.1 .0 beta 1

• Matthew Phillips sticker-src-3.1.0b2.zip
  http://www.tickertape.org/download/get.jsp?package=sticker-src-3.1.0b2 .zip

Sticker Unauthorized Secure Message Sending Vulnerability

References:

• Sticker 3.1.0 beta 2 - Release Notes (Matthew Phillips)
  
• Sticker Home Page (Matthew Phillips)