# MA-724.042019: MyCERT Alert - WhatsApp Messenger Vulnerability

**Date:** 15 May 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-724.042019  
**Advisory ID:** MA-724.042019

---

**1.0 Introduction**
Recently Facebook has released a security advisory to address a vulnerability in WhatsApp Messenger application. Buffer overflow vulnerability found in WhatsApp VOIP stack that allowed attacker to perform remote code execution attack to a target phone number using specially crafted series of SRTCP packets.
**2.0 Impact**
Attackers can spread malicious software by issuing specially crafted VoIP calls to the victim. This attack does not need user interaction to succeed in spreading malicious software.
**3.0 Affected Product**
The issue affects:
- WhatsApp for Android prior to v2.19.134.
- WhatsApp Business for Android prior to v2.19.44.
- WhatsApp for iOS prior to v2.19.51.
- WhatsApp Business for iOS prior to v2.19.51.
- WhatsApp for Windows Phone prior to v2.18.348.
- WhatsApp for Tizen prior to v2.18.15.
**4.0 Recommendations**
Users are advice to update their WhatsApp Messenger application to the latest version immediately.
For iPhone user, this link will be redirected to WhatsApp at App Store for user to check and quickly update to the latest version available. User can search the app using search bar in the App Store to navigate to the WhatsApp page.
App Store: <https://itunes.apple.com/my/app/whatsapp-messenger/id310633997?mt=8>
For android user, this link will be redirected to WhatsApp at Google Play for users to quickly update to the latest version which available across all supported Android devices.
Android phone user are advised to update their devices to the latest version whenever it is available.
Google play store: <https://play.google.com/store/apps/details?id=com.whatsapp>
**5.0    References**
- <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3568>
- <https://www.facebook.com/security/advisories/cve-2019-3568>
- <https://www.ft.com/content/7f2f39b2-733e-11e9-bf5c-6eeb837566c5>
- <https://play.google.com/store/apps/details?id=com.whatsapp>
- <https://itunes.apple.com/us/app/whatsapp-messenger/id310633997>
Generally, MyCERT advises the users of this product to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#8ceff5eee9feb5b5b5cceff5eee9feffe9eff9fee5f8f5a2e1f5) or [[email protected]](/cdn-cgi/l/email-protection#abc6d2c8ced9dfebc6d2c8ced9df85c4d9cc85c6d2)
Phone: 1-300-88-2999 (monitored during business hours)
Handphone: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [iOS Users](https://www.mycert.org.my/portal/advisory?id=MA-720.042019) or [Android Users](https://www.mycert.org.my/portal/advisory?id=MA-720.042019)