Vulnerability CVE-2019-9970
Published: 2019-03-23   Modified: 2019-03-24

Description:
Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets.

Type:

CWE-20

 (Improper Input Validation)

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Signal -> Private messenger 
Signal -> Signal-desktop 
Signal -> Signal private messenger 

 References:
http://www.securityfocus.com/bid/107550
https://github.com/blazeinfosec/advisories/blob/master/signal-advisory.txt
Copyright 2024, cxsecurity.com

 

Back to Top