WhatsApp fixes problem in image filter after CPR flagged security vulnerability – ET CISO
It added that the vulnerability was rooted in WhatsApp’s image filter function and during its research study, CPR learned that switching between various filters on crafted GIF files caused WhatsApp to crash.
“CPR identified one of the crashes as memory corruption. CPR promptly reported the problem to WhatsApp, who named for the vulnerability CVE-2020-1910, detailing it as an out-of-bounds read and write issue,” it noted.
Successful exploitation of the vulnerability would have required an attacker to apply specific image filters to a specially crafted image and send the resulting image, it added.
“With over two billion active users, WhatsApp can be an attractive target for attackers. Once we discovered the security vulnerability, we quickly reported our findings to WhatsApp, which was cooperative and collaborative in issuing a fix. The result of our collective efforts is a safer WhatsApp for users worldwide,” Check Point Head of ProductsResearch said.
When contacted, a WhatsApp spokesperson said the company regularly works with security researchers “to improve the numerous ways WhatsApp protects people’s messages, and we appreciate the work that Check Point does to investigate every corner of our app”.
“People should have no doubt that end-to-end encryption continues to work as intended and people’s messages remain safe and secure,” the spokesperson added.