WhatsApp Vulnerability Could Have Allowed Attackers to Hijack Phones Using Malicious GIFs

guest · Oct 3, 2019

WhatsApp Vulnerability Could Have Allowed Attackers to Hijack Phones Using Malicious GIFs
October 2, 2019
https://gizmodo.com/whatsapp-vulnerability-could-have-allowed-attackers-to-1838719025

A security researcher discovered a vulnerability in the Facebook-owned app that could allow attackers to obtain access to a device and steal data by sending a malicious GIF file, The Next Web reported on Wednesday

The issue is a double-free vulnerability, i.e. a memory corruption issue that can crash apps or create an opening for a hacker to compromise the security of the affected device. According to the technical write-up, if an attacker sends a WhatsApp user such a modified GIF, the next time that users opens their WhatsApp photo gallery, the bug will strike. It seems that users running certain versions of the Android mobile OS are most likely to be impacted by the bug.

“The exploit works well until WhatsApp version 2.19.230,” the developer, Awakened, wrote. “The vulnerability is official patched in WhatsApp version 2.19.244.”
WhatsApp told The Next Web it had no reason to suspect any users were impacted and that it had resolved the issue in a patch.
Click to expand...

guest · Nov 26, 2019

Many Apps Impacted by GIF Processing Flaw Patched Recently in WhatsApp
November 26, 2019
https://www.securityweek.com/many-apps-impacted-gif-processing-flaw-patched-recently-whatsapp

Tracked as CVE-2019-11932, the security flaw exists in the open source library named libpl_droidsonroids_gif.so, which is part of the android-gif-drawable package and is used by numerous Android applications when processing GIF files.
WhatsApp for Android was one of the impacted applications and Facebook patched it recently with the release of version 2.19.244. However, many other apps still use a vulnerable version of the library.

The security vulnerability has been fixed in libpl_droidsonroids_gif.so for nearly two months, but many of the developers relying on it have yet to update their packages to use the patched iteration.
According to Trend Micro, there are over 3,000 applications in Google Play that use the vulnerable library, thus potentially putting their users at risk.

“If you accidentally install a vulnerable application, you will be at risk, as an attacker may be able to exploit this vulnerability to take control of this device. We urge developers to upgrade libpl_droidsonroids_gif.so if they are using it to reduce the risk to end users,” Trend Micro concludes.
Click to expand...

Trend Micro: Patched GIF Processing Vulnerability CVE-2019-11932 Still Afflicts Multiple Mobile Apps

Log in or Sign up

WhatsApp Vulnerability Could Have Allowed Attackers to Hijack Phones Using Malicious GIFs

guest Guest

guest Guest

Log in or Sign up

WhatsApp Vulnerability Could Have Allowed Attackers to Hijack Phones Using Malicious GIFs

guest Guest

guest Guest

Useful Searches