CVE-2020-1908 : Security Advisory and Response
CVE-2020-1908 concerns an improper authorization vulnerability in WhatsApp and WhatsApp Business for iOS versions prior to 2.20.100, allowing unauthorized access via Siri. Learn how to mitigate this issue.
WhatsApp for iOS and WhatsApp Business for iOS versions prior to 2.20.100 are affected by an improper authorization vulnerability.
Understanding CVE-2020-1908
This CVE concerns an issue with the Screen Lock feature in WhatsApp and WhatsApp Business for iOS that could allow Siri to interact with the app even when the phone is locked.
What is CVE-2020-1908?
This CVE pertains to the improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS versions prior to 2.20.100, potentially allowing unauthorized access via Siri.
The Impact of CVE-2020-1908
The vulnerability could lead to unauthorized access to the WhatsApp application through Siri, compromising user privacy and security on iOS devices.
Technical Details of CVE-2020-1908
WhatsApp and WhatsApp Business for iOS versions prior to 2.20.100 are susceptible to this vulnerability.
Vulnerability Description
The vulnerability arises from improper authorization of the Screen Lock feature, enabling interaction with WhatsApp via Siri on locked devices.
Affected Systems and Versions
- Product: WhatsApp Business for iOS
- Vendor: Facebook
- Affected Version: 2.20.100
- Versions less than 2.20.100 are also impacted.
- Product: WhatsApp for iOS
- Vendor: Facebook
- Affected Version: 2.20.100
- Versions less than 2.20.100 are also affected.
Exploitation Mechanism
Unauthorized access to WhatsApp via Siri due to a lack of proper authorization in the Screen Lock feature of affected iOS versions.
Mitigation and Prevention
Implement immediate and long-term security measures to mitigate the risks associated with CVE-2020-1908.
Immediate Steps to Take
- Update WhatsApp and WhatsApp Business for iOS to version 2.20.100 or higher.
- Avoid using Siri to interact with WhatsApp on locked devices.
Long-Term Security Practices
- Regularly update applications to the latest versions to patch known vulnerabilities.
Patching and Updates
- Facebook has released version 2.20.100 to address this vulnerability in WhatsApp and WhatsApp Business for iOS.