CERT-In Vulnerability Note
CIVN-2019-0080
Buffer Overflow Vulnerability in WhatsApp
Original Issue Date:May 17, 2019
Severity Rating: HIGH
Software Affected
- WhatsApp for Android prior to 2.19.134
- WhatsApp Business for Android prior to v2.19.44
- WhatsApp for iOS prior to v2.19.51
- WhatsApp Business for iOS prior to v2.19.51
- WhatsApp for Windows Phone prior to v2.18.348
- WhatsApp for Tizen prior to v2.18.15
Overview
A vulnerability has been reported in WhatsApp which could be exploited by a remote attacker to execute arbitrary code on the affected system.
Description
This vulnerability exists in WhatsApp due to a buffer overflow condition error. A remote attacker could exploit this vulnerability by making a decoy Whatsapp voice call to a target user¿s phone number and thereby sending specially crafted series of SRTCP packets to the target system. This could trigger a buffer overflow condition leading to execution of arbitrary code by the attacker.
Successful exploitation of this vulnerability could allow the attacker to access information on the system such as call logs, messages, photos, etc which could lead to further compromise of the system.
Solution
- Upgrade to latest version of WhatsApp
Vendor Information
Facebook
https://www.facebook.com/security/advisories/cve-2019-3568
References
Facebook
https://www.facebook.com/security/advisories/cve-2019-3568
Hacker News
https://thehackernews.com/2019/05/hack-whatsapp-vulnerability.html
Checkpoint
https://research.checkpoint.com/the-nso-whatsapp-vulnerability-this-is-how-it-happened/
CVE Name
CVE-2019-3568
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|