Malicious change in mixed transactions

[tsusanka]

Impact: Theft of Funds
Scalability: Remote (Interaction)
Severity: Critical
Fixed in: Firmware 1.3.1
Reported by: Nicolas Bacca
Date reported: 2015-02-23

Detail

A specially crafted multisig transaction could leverage a ToCToU bug to include a change output of an attacker, which wasn't confirmed by the user.

Fix

trezor/trezor-firmware@137a60c