What is WhatsApp’s Zero-Day Vulnerability Leading Users into Danger?

What is WhatsApp’s Zero-Day vulnerability leading users into danger?

[{"selector":"#anim-1e609eb9-814c-41ea-9183-d44032e127e9","keyframes":{"opacity":[0,1]},"delay":300,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-feac39e1-d2bb-4ac3-b7c8-52995eca989d","keyframes":{"transform":["translate3d(0px, 147.48153%, 0)","translate3d(0px, 0px, 0)"]},"delay":300,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-e104a2f5-4853-49b3-b711-b01752f7274a","keyframes":{"opacity":[0,1]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-6fe6a247-a0fd-4ef4-9e27-7e7c54fa41df","keyframes":{"transform":["rotate(90deg) translate3d(-59.94318%, 0px, 0) rotate(-90deg)","rotate(90deg) translate3d(0px, 0px, 0) rotate(-90deg)"]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

Govrn has issued an advisory to WhatsApp users, warning of multiple vulnerabilities in the instant messaging platform.

[{"selector":"#anim-71422cd6-5d06-4f49-9e7c-47a406cb56d5","keyframes":{"opacity":[0,1]},"delay":400,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-db0ee9c4-11cd-4cf0-858d-c4df3b165e2e","keyframes":{"transform":["translate3d(0px, 131.94446%, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-3f0e50c5-d75f-4be5-a84c-7f49544aac13","keyframes":{"opacity":[0,1]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-3ffee974-aae5-492d-99f2-1b3e7358ae06","keyframes":{"transform":["rotate(90deg) translate3d(-59.94318%, 0px, 0) rotate(-90deg)","rotate(90deg) translate3d(0px, 0px, 0) rotate(-90deg)"]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

warning

[{"selector":"#anim-03d2f6c9-c2bc-4bbf-a38d-cc285269c999","keyframes":{"opacity":[0,1]},"delay":400,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-f7cd37cb-266d-4743-871f-2241bfc41048","keyframes":{"transform":["translate3d(0px, 121.24898%, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-b254b0bc-a7d8-49a9-9455-205de7ff78df","keyframes":{"opacity":[0,1]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-3903b4a3-9226-4d25-9003-122aff73490d","keyframes":{"transform":["rotate(90deg) translate3d(-59.94318%, 0px, 0) rotate(-90deg)","rotate(90deg) translate3d(0px, 0px, 0) rotate(-90deg)"]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] The Indian Computer Emergency Response Team (CERT-IN), a nodal agency under the Ministry of Electronics and Information Technology, has warned of vulnerabilities in WhatsApp for Android and iOS prior to v2.22.16.12

WhatsApp Business for Android and iOS prior to v2.22.16.12, WhatsApp for Android prior to v2.22.16.12 and WhatsApp for iOS for v2.22.15.9

[{"selector":"#anim-800ef836-f611-436f-8b97-0e6e810384a0","keyframes":{"opacity":[0,1]},"delay":400,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-2d92c711-6a7b-4929-9342-6f24e1096c1e","keyframes":{"transform":["translate3d(0px, 127.77778%, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-a097ec1f-5362-4a39-98e1-08fcdd9b047a","keyframes":{"opacity":[0,1]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-61982c80-971e-4494-9268-db3b426cfeda","keyframes":{"transform":["rotate(90deg) translate3d(-59.94318%, 0px, 0) rotate(-90deg)","rotate(90deg) translate3d(0px, 0px, 0) rotate(-90deg)"]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

The CERT-in advisory has warned of multiple vulnerabilities in WhatsApp which could help a remote attacker to execute an arbitrary code on the targeted system.

[{"selector":"#anim-30b1f8d4-770e-412f-a623-a17c8862d6c5","keyframes":{"opacity":[0,1]},"delay":400,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-d6d9080f-19d9-4b99-9d30-8c1f4b3b688b","keyframes":{"transform":["translate3d(0px, 124.14440%, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-87cff833-3594-441a-9b16-36072e66ce8a","keyframes":{"opacity":[0,1]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-9b909ae0-8fe1-4ea1-ad85-4d4fbd420069","keyframes":{"transform":["rotate(90deg) translate3d(-59.94318%, 0px, 0) rotate(-90deg)","rotate(90deg) translate3d(0px, 0px, 0) rotate(-90deg)"]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

According to the Centre's advisory, the vulnerability exists in WhatsApp due to integer overflow.

[{"selector":"#anim-5b6bcce0-6e75-44d1-88cb-2ca65f2568f7","keyframes":{"opacity":[0,1]},"delay":400,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-71c1a485-f797-471a-b29f-e89ae4455ca4","keyframes":{"transform":["translate3d(0px, 164.73765%, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-f6b1409e-c7e4-464b-8702-4a5dc1ed8cdb","keyframes":{"opacity":[0,1]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-bd938bd2-fe38-4068-9e9f-099fae318eef","keyframes":{"transform":["rotate(90deg) translate3d(-59.94318%, 0px, 0) rotate(-90deg)","rotate(90deg) translate3d(0px, 0px, 0) rotate(-90deg)"]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

“A remote attacker could exploit this vulnerability to execute remote code in an established video call.”

[{"selector":"#anim-34dc85c8-6829-487a-9fa4-aa2d08ebcb02","keyframes":{"opacity":[0,1]},"delay":400,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-e066fda2-7d4f-4433-a368-4af7291021db","keyframes":{"transform":["translate3d(0px, 169.59878%, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-f08ed077-a622-48b1-90f0-108154357a73","keyframes":{"opacity":[0,1]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-c2c14cf8-beb8-40eb-aae7-dc06fdb073ff","keyframes":{"transform":["rotate(90deg) translate3d(-59.94318%, 0px, 0) rotate(-90deg)","rotate(90deg) translate3d(0px, 0px, 0) rotate(-90deg)"]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

To protect themselves from such an attack, the WhatsApp users should update the app.

[{"selector":"#anim-aead6388-08cb-4259-8c43-87187f078b77","keyframes":{"opacity":[0,1]},"delay":400,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-23ed061e-3296-4f49-9d86-9ab4dc07729a","keyframes":{"transform":["translate3d(0px, 169.59878%, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-373c5b1d-82d6-4af3-956a-c714600f9d9b","keyframes":{"opacity":[0,1]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-c6c04063-add2-49f5-aa7e-7023bf8fedd4","keyframes":{"transform":["rotate(90deg) translate3d(-59.94318%, 0px, 0) rotate(-90deg)","rotate(90deg) translate3d(0px, 0px, 0) rotate(-90deg)"]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

This comes at a time when WhatsApp has introduced new features for its users, the latest being ‘Call Link'.

[{"selector":"#anim-7e8557b4-f71a-4f18-88fc-ab93f58240c0","keyframes":{"opacity":[0,1]},"delay":400,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-02f4f645-1fc0-43f9-a411-6c79a08ef3bd","keyframes":{"transform":["translate3d(0px, 141.60356%, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-f7733646-8952-433d-b9b6-9da7ec312abc","keyframes":{"opacity":[0,1]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-d5ceb887-edfa-477c-8130-a9a03aca7071","keyframes":{"transform":["rotate(90deg) translate3d(-59.94318%, 0px, 0) rotate(-90deg)","rotate(90deg) translate3d(0px, 0px, 0) rotate(-90deg)"]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

warning

[{"selector":"#anim-21a5bf98-0dca-4d31-9130-ebcf5b78b008","keyframes":{"opacity":[0,1]},"delay":400,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-15e961fb-be94-4a95-9606-340f69d5015b","keyframes":{"transform":["translate3d(0px, 170.48798%, 0)","translate3d(0px, 0px, 0)"]},"delay":400,"duration":1000,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-b90e75d4-e59d-4114-9613-f1cea9ee6f9a","keyframes":{"opacity":[0,1]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-f3612fe6-377d-4615-9049-2d5ee7b304b3","keyframes":{"transform":["rotate(90deg) translate3d(-59.94318%, 0px, 0) rotate(-90deg)","rotate(90deg) translate3d(0px, 0px, 0) rotate(-90deg)"]},"delay":50,"duration":3500,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] The feature helps users to join or start video and audio calls with just one tap. The users can easily share this call link individually and invite others to join the calls. Learn more