PT-2020-18674 · Signal · Signal Private Messenger

David Wells · Published 2020-05-20 · Updated 2022-04-07 · CVE-2020-5753

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Signal Private Messenger Android versions 4.59.0 and up Signal Private Messenger iOS versions 3.8.1.5 and up

Description The issue allows a remote non-contact to ring a victim's Signal phone and disclose the currently used DNS server due to ICE Candidate handling before the call is answered or declined. This occurs because of improper handling of ICE candidates, which can lead to information disclosure about the victim's network setup.

Recommendations For Signal Private Messenger Android versions 4.59.0 and up, consider disabling call functionality until a patch is available. For Signal Private Messenger iOS versions 3.8.1.5 and up, restrict access to call features to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2020-5753

Affected Products

Signal Private Messenger

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-5753 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5753 · Vendor Advisory
• https://tenable.com/security/research/tra-2020-33 · Note
• https://t.me/malwr/3713 · Telegram Post
• https://t.me/cvenotify/28597 · Telegram Post
• https://t.me/cvenotify/3943 · Telegram Post