WhatsApp Vulnerability Could Allow Installing Spyware Via MP4 Videos

Sharing videos on WhatsApp is a cool feature. However, due to a bug, this feature could have become a security threat for users. Facebook has recently revealed a WhatsApp vulnerability that could allow installing malware to target devices.

WhatsApp Vulnerability Triggered Through MP4 Videos

Facebook has disclosed a serious WhatsApp vulnerability that exposed users to potential malware attacks.

As disclosed in an advisory, the stack-based buffer overflow vulnerability existed in almost all WhatsApp versions for both the consumers and enterprise apps. To trigger the flaw, an attacker would simply have to send maliciously crafted MP4 videos to the target users.

Describing this vulnerability CVE-2019-11931, Facebook stated,

A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE.

Exploiting the bug could allow the attacker to execute remote code. It also permitted the attacker to install spyware or any other malware to the victim’s device.

Facebook Released The Patched Version

Fortunately, Facebook have fixed the vulnerability with the release of WhatsApp updates rolled out on November 13, 2019. Therefore, if the users are running the following vulnerable app versions, they must ensure updating their respective devices accordingly.

• WhatsApp for Android versions prior to 2.19.274
• WhatsApp for iOS versions prior to 2.19.100
• Windows Phone versions including and prior to 2.18.368
• WhatsApp Enterprise Client versions prior to 2.25.3
• Business for Android versions prior to 2.19.104
• Business for iOS versions prior to 2.19.100

A Facebook spokesperson confirmed no exploitation of the flaw.

WhatsApp is constantly working to improve the security of our service. We make public reports on potential issues we have fixed consistent with industry best practices. In this instance, there is no reason to believe that users were impacted.

In October, Facebook also fixed another bug in WhatsApp that could allow hijacking chat sessions using malicious GIFs.

Let us know your thoughts in the comments.

The following two tabs change content below.

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]

Related