CERT-In Advisory
CIAD-2020-0082
Authentication Bypass Vulnerability in Facebook Messenger for Android
Original Issue Date: November 23, 2020
Severity Rating: High
Software Affected
- Facebook Messenger for Android version 284.0.0.16.119 and earlier
Overview
A vulnerability has been reported in Facebook Messenger for Android which could allow a remote attacker to access sensitive information by bypassing security restrictions on a targeted system.
Description
This vulnerability exists in the Session Description Protocol (SDP) of WebRTC component in the affected software due to auto-approval of WebRTC connections without authentication. An attacker having permissions to make an audio call to a target could exploit this vulnerability by sending a specially crafted message.
Successful exploitation of this vulnerability could allow the attacker to listen to the audio from the targeted device while it is still ringing.
Solution
- Update the Facebook Messenger for Android to the latest version from Google Play Store.
Vendor Information
Facebook
https://about.fb.com/news/2020/11/bug-bounty-program-10th-anniversary/
References
Google Project Zero
https://bugs.chromium.org/p/project-zero/issues/detail?id=2098
Bleeping Computer
https://www.bleepingcomputer.com/news/security/facebook-messenger-bug-allowed-android-users-to-spy-on-each-other/
ZDnet
https://www.zdnet.com/article/facebook-messenger-bug-could-have-allowed-hackers-to-spy-on-users/
Threatpost
https://threatpost.com/facebook-messenger-bug-spying-android/161435/
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|