Cryptocat Multiparty Encryption Scheme Information Disclosure Vulnerability

Bugtraq ID:	61110
Class:	Design Error
CVE:	CVE-2013-4105
Remote:	Yes
Local:	No
Published:	Nov 07 2012 12:00AM
Updated:	Nov 07 2012 12:00AM
Credit:	Mario Heiderich, Krzysztof Kotowicz and Maxim Rupp
Vulnerable:	Cryptocat Project Cryptocat 2.0.21 Cryptocat Project Cryptocat 2.0.20 Cryptocat Project Cryptocat 2.0.12 Cryptocat Project Cryptocat 2.0.11 Cryptocat Project Cryptocat 2.0.10 Cryptocat Project Cryptocat 2.0.1 Cryptocat Project Cryptocat 2.0
Not Vulnerable:	Cryptocat Project Cryptocat 2.0.22

Cryptocat Multiparty Encryption Scheme Information Disclosure Vulnerability

Cryptocat is prone to an information disclosure vulnerability.

An attacker can exploit this issue to break the encryption and gain access to sensitive information that may aid in further attacks.

Versions prior to Cryptocat 2.0.22 are vulnerable.

Cryptocat Multiparty Encryption Scheme Information Disclosure Vulnerability

An attacker can exploit this issue using readily available tools.

Cryptocat Multiparty Encryption Scheme Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cryptocat Multiparty Encryption Scheme Information Disclosure Vulnerability

References:

• Cryptocat Changelog (Cryptocat)
  
• Cryptocat Homepage (Cryptocat)
  
• Cure53 Public Pentest Report: Cryptocat 2 (Dr.-Ing. Mario Heiderich, Krzysztof Kotowicz & Maxim Rupp )
  
• Security Update: A Follow-up (Cryptocat)