WhatsApp Patches Vulnerability in Image Filter Function That Could Have Led to Data Exposure

WhatsApp has patched a vulnerability that might permit an attacker to learn delicate info from the app’s reminiscence, together with personal messages utilizing a specifically crafted picture. The vulnerability was reported to WhatsApp by cybersecurity agency Test Level Analysis, and it existed inside the picture filter perform of WhatsApp for Android and WhatsApp Enterprise for Android that permits customers so as to add filters to their pictures. The Fb-owned firm fastened the safety concern after it was reported by Test Level researchers and claimed that there was no proof that the vulnerability was ever abused.

Known as “Out-Of-Bounds read-write vulnerability”, the problem was disclosed to WhatsApp by Test Level Analysis on November 10, 2020. WhatsApp took a while in fixing the bug and issued a patch in February. It was offered to finish customers by way of the model 2.21.1.13 of each WhatsApp for Android and WhatsApp Enterprise for Android apps.

Researchers at Test Level Analysis had been capable of uncover the vulnerability that’s technically a reminiscence corruption concern whereas trying on the approach WhatsApp processes and sends pictures on its platform. In the course of the analysis, it was discovered that the picture filter perform of the messaging app crashes when it was used with some specially-designed GIF recordsdata. That introduced the researchers to the purpose from the place they had been capable of spot the loophole.

Based on Test Level Analysis, the vulnerability may very well be triggered after a person opens an attachment containing a maliciously crafted picture file, tries to use a filter, after which sends the picture with the filter utilized again to the attacker. The researchers, thus, famous that hackers would have required “complicated steps and in depth person interplay” to use the problem.

Nevertheless, if it may very well be efficiently exploited, the vulnerability is claimed to permit hackers to learn delicate info from WhatsApp reminiscence that embody personal messages and beforehand shared pictures and movies.

“As soon as we found the safety vulnerability, we rapidly reported our findings to WhatsApp, who was cooperative and collaborative in issuing a repair. The results of our collective efforts is a safer WhatsApp for customers worldwide,” mentioned Oded Vanunu, Head of Merchandise Vulnerabilities Analysis at Test Level, in a ready assertion.

WhatsApp has listed the small print of the vulnerability on its safety advisories website as CVE-2020-1910. The platform added two new checks on supply and filter pictures to limit reminiscence entry.

ADVERTISEMENT

“Folks should not have any doubt that end-to-end encryption continues to work as supposed and other people’s messages stay secure and safe,” WhatsApp mentioned in its assertion given to Test Level Analysis. “This report includes a number of steps a person would have wanted to take and we now have no purpose to imagine customers would have been impacted by this bug. That mentioned, even essentially the most complicated eventualities researchers establish will help improve safety for customers.”

WhatsApp additionally beneficial its customers to maintain their apps and working methods updated, obtain updates every time they’re out there, report suspicious messages, and attain out on to its workforce in the event that they expertise points utilizing WhatsApp.