PT-2019-14995 · W3C+1 · Webrtc+1

CVE-2019-17192 · Publicado 2019-10-05 · Atualizado 2024-08-05

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Signal Private Messenger versions through 4.47.7 for Android

Description The issue is related to the WebRTC component in the Signal Private Messenger application, which processes videoconferencing RTP packets before a callee chooses to answer a call. This behavior might make it easier for remote attackers to cause a denial of service or possibly have unspecified other impact via malformed packets. The vendor plans to continue this behavior for performance reasons unless a WebRTC design change occurs.

Recommendations For Signal Private Messenger versions through 4.47.7 for Android, consider disabling the WebRTC component until a design change or further guidance is provided by the vendor. As a temporary workaround, restrict the use of videoconferencing features to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-670

Identificadores relacionados

CVE-2019-17192

Produtos afetados

Signal Private Messenger

Webrtc

Referências · 7

• https://news.ycombinator.com/item?id=21161432 · Nota
• https://t.me/cvenotify/89098 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-17192 · Aviso do Fabricante
• https://t.me/cvenotify/28595 · Publicação no Telegram
• https://twitter.com/moxie/status/1180226374851710976 · Nota
• https://bugs.chromium.org/p/project-zero/issues/detail?id=1936 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-17192 · Nota de Segurança