Insufficient verification of data authenticity in Signal - #VU49847
Published: January 20, 2021
Vulnerability identifier: #VU49847
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-345
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the way the mobile application implements WebRTC features for voice and video communications. A remote attacker can send specially crafted SDP messages to the affected device while the victim is trying to make a voice or video call and intercept video and audio fragments from the victim's phone before the call is accepted by the callee.
Affected software
Signal
Remediation
Install updates from vendor's website.
Signal - update to 4.48.7