WhatsApp Messenger 2.11.431/2.11.432 于 Android Message 拒绝服务

CVSS 元临时分数	当前攻击价格 (≈)	CTI兴趣分数
4.8	$0-$5k	0.00

摘要信息

在WhatsApp Messenger 2.11.431/2.11.432中曾发现分类为棘手的漏洞。此漏洞会影响未知代码的组件Message Handler。对的操作导致拒绝服务。此外，存在可用的漏洞利用。

在WhatsApp Messenger 2.11.431/2.11.432中曾发现分类为棘手的漏洞。此漏洞会影响未知代码的组件Message Handler。对的操作导致拒绝服务。通过 CWE 声明此问题将指向 CWE-404。此漏洞的脆弱性 2014-12-01由公示人Indrajeet Bhuyan、公示人身份Crash Your Friends' WhatsApp Remotely with Just a Message、公示人类型为News (网站)所披露。您可以在 thehackernews.com 下载该通告。此次公开发布未经供应商参与。

没有可用的技术细节。该漏洞的流行度高于平均水平。此外，存在可用的漏洞利用。漏洞利用已被公开，可能会被利用。当前，大致为 USD $0-$5k。公告指出：

In a video demonstration, they showed that how a 2000 words (2kb in size) message in special character set can crash Whatsapp messenger app. Previous it was discovered that sending a huge message ( greater than 7mb in size) on Whatsapp could crash victim device and app immediately, but using this new exploit attacker only need to send a very small size (approx 2kb) message to the victim.

如果存在长度，则其被声明为概念验证。以下网址提供该漏洞利用：pastebin.com。估计零日攻击的地下价格约为$5k-$25k。

公告包含以下备注：

The worried impact of the vulnerability is that the user who received the specially crafted message will have to delete his/her whole conversation and start a fresh chat, because opening the message keeps on crashing WhatsApp unless the chat is deleted completely.

此漏洞同样在其他漏洞数据库中有记录：SecurityFocus (BID 71410) , X-Force (99282)。