High severity · published Mar 29, 2017
CVE-2016-2379
The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of client registration…
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of client registration codes or (2) gain login access by eavesdropping on login messages and re-using the hashed passwords.
CVSS vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MX
Mxit · Pidgin
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-2379
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-2379
Third Party Advisory
http://www.securityfocus.com/bid/91335
Third Party Advisory
http://www.talosintelligence.com/reports/TALOS-2016-0122/
Vendor Advisory
https://pidgin.im/news/security/?id=95
Third Party Advisory
https://security.gentoo.org/glsa/201701-38