Summaryinfo

A vulnerability was found in WhatsApp Messenger 2.11.431/2.11.432 on Android. It has been declared as problematic. This affects an unknown function of the component Message Handler. The manipulation results in denial of service. Furthermore, an exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in WhatsApp Messenger 2.11.431/2.11.432 on Android (Messaging Software). Affected is some unknown processing of the component Message Handler. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability.

The weakness was published 12/01/2014 by Indrajeet Bhuyan as Crash Your Friends' WhatsApp Remotely with Just a Message as not defined news (Website). The advisory is shared for download at thehackernews.com. The public release happened without coordination with the vendor. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but a public exploit is available. The advisory points out:

In a video demonstration, they showed that how a 2000 words (2kb in size) message in special character set can crash Whatsapp messenger app. Previous it was discovered that sending a huge message ( greater than 7mb in size) on Whatsapp could crash victim device and app immediately, but using this new exploit attacker only need to send a very small size (approx 2kb) message to the victim.

A public exploit has been developed in Binary Data and been published immediately after the advisory. The exploit is shared for download at pastebin.com. It is declared as proof-of-concept.

The news contains the following remark:

The worried impact of the vulnerability is that the user who received the specially crafted message will have to delete his/her whole conversation and start a fresh chat, because opening the message keeps on crashing WhatsApp unless the chat is deleted completely.

The vulnerability is also documented in the databases at X-Force (99282) and SecurityFocus (BID 71410†). Further details are available at spiegel.de. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Not Affected

• Apple iOS
• Microsoft Windows Phone
• RIM BlackBerry

Productinfo

Type

• Messaging Software

Name

• WhatsApp Messenger

Version

• 2.11.431
• 2.11.432

License

• free

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

Video

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion