WhatsApp fixes bug that would have let hackers exploit devices using MP4 files

WhatsApp has fixed a vulnerability involving malicious MP4 video files that could potentially allow an attacker to remotely access messages and files stored in the app.

The flaw — identified as CVE-2019-11931 — made it possible for attackers to send a specially crafted MP4 file to remotely execute malicious code on the victim’s device without any intervention.

In an advisory posted on its site, Facebook said:

A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS [denial of service] or RCE [remote code execution].

However, the presence of the flaw alone doesn’t mean it could be used for nefarious purposes. As is often the case, it can be an entry point for an exploit chain that links together a group of security vulnerabilities, thereby allowing a hacker to penetrate digital protections.

When we reached out for a response, a spokesperson for the company said, “WhatsApp is constantly working to improve the security of our service. We make public, reports on potential issues we have fixed consistent with industry best practices. In this instance there is no reason to believe users were impacted.”

The bug affected Android versions prior to 2.19.274, iOS versions prior to 2.19.100, Enterprise Client versions prior to 2.25.3, Windows Phone versions before and including 2.18.368, Business for Android versions prior to 2.19.104, and Business for iOS versions prior to 2.19.100.

Webinar: Unicorn DNA: The Blueprint for Scaling Success

What does it take to build a unicorn? On November 19, 3pm CET, top executives of unicorn companies will reveal the mindset, strategies, and innovative thinking that propelled their companies to the top.

While there’s no indication that the flaw was exploited, the disclosure comes weeks after WhatsApp revealed that at least two dozen academics, lawyers, Dalit activists, and journalists in India were the target of surveillance by threat operators using security firm NSO Group’s Pegasus spyware.

The social media giant has also sued the Israeli company for exploiting a now-fixed video calling flaw in WhatsApp service to surveil over 1,400 users.

In the meantime, it is crucial that you update WhatsApp to the latest version to mitigate the risk of exploit.