WebRTC Component Vulnerability in Signal Private Messenger for Android
CVE-2019-17192

9.8CRITICAL

Key Information:

Vendor

Signal

Status
Private Messenger
Vendor
CVE Published:
5 October 2019

What is CVE-2019-17192?

The WebRTC component within the Signal Private Messenger application on Android inadvertently processes videoconferencing RTP packets before the call is answered. This could allow remote attackers to exploit malformed packets, potentially resulting in a denial of service or unintentional consequences during a video call. The vendor has indicated a preference for maintaining this behavior for performance improvements unless a redesign is implemented in the WebRTC architecture.

References

https://news.ycombinator.com/item?id=21161432
x_refsource_MISC
https://twitter.com/moxie/status/1180226374851710976
x_refsource_MISC
https://bugs.chromium.org/p/project-zero/issues/detail?id...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.