5 - VU#704916

Executive Summary

Summary
Title	The TigerText Free Consumer Private Texting App (iOS) sends unencrypted user information in support requests

Informations
Name	VU#704916	First vendor Publication	2013-04-02
Vendor	VU-CERT	Last vendor Modification	2013-04-02
Severity (Vendor)	N/A	Revision	M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#704916

The TigerText Free Consumer Private Texting App (iOS) sends unencrypted user information in support requests

Original Release date: 02 Apr 2013 | Last revised: 02 Apr 2013

Overview

The TigerText Free Consumer Private Texting App (iOS) sends unencrypted user information to TigerText support.

Description

The TigerText app generates an unencrypted log file containing the TigerText username and password on the device when a user taps on "Contact Customer Support." An email is generated to support that sends the log information with it. This does not impact the TigerText Pro application.

Impact

TigerText usernames and passwords may be viewable by TigerText support or others with access to the device or email. A recipient of the email containing the log file could use credentials to impersonate the user, gaining unauthorized access to any non-expired messages.

Solution

Apply an Update

An updated app is available from the iTunes App Store. Version 3.1.402 or above contains a patch that removes sensitive information from the log file. The latest version is available here: https://itunes.apple.com/us/app/tiger-text/id355832697?mt=8

Vendor Information (Learn More)

Vendor	Status	Date Notified	Date Updated
TigerText	Affected	07 Feb 2013	18 Mar 2013

If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group	Score	Vector
Base	1.7	AV:L/AC:L/Au:S/C:P/I:N/A:N
Temporal	1.4	E:F/RL:OF/RC:C
Environmental	0.4	CDP:N/TD:L/CR:ND/IR:ND/AR:ND

References

https://itunes.apple.com/us/app/tiger-text/id355832697?mt=8
http://cwe.mitre.org/data/definitions/260.html

Credit

Thanks to Pedro Paixao for reporting this vulnerability.

This document was written by Chris King.

Other Information

CVE IDs:CVE-2013-0128
Date Public:02 Apr 2013
Date First Published:02 Apr 2013
Date Last Updated:02 Apr 2013
Document Revision:16

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Original Source

Url : http://www.kb.cert.org/vuls/id/704916

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-255	Credentials Management

Alert History

If you want to see full details history, please login or register.

Date	Informations
2013-05-11 05:18:26	Multiple Updates
2013-04-05 17:20:03	Multiple Updates
2013-04-05 00:19:24	Multiple Updates
2013-04-03 13:17:25	First insertion