CVE-2019-9970

Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/107550	Third Party Advisory VDB Entry
https://github.com/blazeinfosec/advisories/blob/master/signal-advisory.txt	Third Party Advisory
http://www.securityfocus.com/bid/107550	Third Party Advisory VDB Entry
https://github.com/blazeinfosec/advisories/blob/master/signal-advisory.txt	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:signal:private_messenger::::::android::*
	cpe:2.3:a:signal:signal-desktop::::::::

History

No history.

Information

Published : 2019-03-24 02:29

Updated : 2024-11-21 04:52

NVD link : CVE-2019-9970

Mitre link : CVE-2019-9970

CVE.ORG link : CVE-2019-9970

JSON object : View

Products Affected

signal

private_messenger
signal-desktop

CWE

NVD-CWE-noinfo

{"id": "CVE-2019-9970", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2019-03-24T02:29:00.670", "references": [{"url": "http://www.securityfocus.com/bid/107550", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://github.com/blazeinfosec/advisories/blob/master/signal-advisory.txt", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/107550", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/blazeinfosec/advisories/blob/master/signal-advisory.txt", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets."}, {"lang": "es", "value": "Open Whisper Signal (tambi\u00e9n conocido como Signal-Desktop) hasta la versi\u00f3n 1.23.1, as\u00ed como la aplicaci\u00f3n Signal Private Messenger hasta la versi\u00f3n 4.35.3 para Android, son vulnerables a un ataque hom\u00f3grafo IDN al mostrar mensajes que contienen URL. Esto ocurre debido a que la aplicaci\u00f3n produce un enlace clicable incluso si, por ejemplo, existen caracteres latinos y cir\u00edlicos en el mismo nombre de dominio y la fuente disponible tiene una representaci\u00f3n id\u00e9ntica de caracteres de diferentes alfabetos."}], "lastModified": "2024-11-21T04:52:42.287", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:signal:private_messenger:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "62886A5F-FA19-4E16-8E1E-195302310554", "versionEndIncluding": "4.35.3"}, {"criteria": "cpe:2.3:a:signal:signal-desktop:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7AB79BE-52F8-409C-99FA-BB273862CDB4", "versionEndIncluding": "1.23.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}