Multiple vulnerabilities in WhatsApp



Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2020-1890
CVE-2020-1886
CWE-ID CWE-20
CWE-787
Exploitation vector Network
Public exploit N/A
Vulnerable software
 WhatsApp Messenger for Android
Mobile applications / Apps for mobile phones

WhatsApp Business for Android
Mobile applications / Apps for mobile phones

Vendor WhatsApp

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU46538

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-1890

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a URL validation issue. A remote attacker can cause the recipient of a sticker message containing deliberately malformed data to load an image from a sender-controlled URL without user interaction.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

WhatsApp Messenger for Android: before 2.20.11

WhatsApp Business for Android: before 2.20.2

CPE2.3 External links

https://www.whatsapp.com/security/advisories/2020


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to perform certain actions on the device.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds write

EUVDB-ID: #VU46536

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-1886

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input. A remote attacker can trigger out-of-bounds write via a specially crafted video stream after receiving and answering a malicious video call and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

WhatsApp Messenger for Android: before 2.20.11

WhatsApp Business for Android: before 2.20.2

CPE2.3 External links

https://www.whatsapp.com/security/advisories/2020


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to perform certain actions on the device.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###