Rule Document 1:51953

Rule Category

OS-MOBILE -- Snort has detected traffic targeting vulnerabilities in a mobile-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself.

Alert Message

OS-MOBILE Android WhatsApp malformed GIF double-free remote code execution attempt

Rule Explanation

This event is generated when an attempt to trigger a double-free in Android's WhatsApp application using a GIF is performed. Impact: Remote Code Execution Details: The WhatsApp Android application suffers from a double-free memory corruption vulnerability when parsing a malformed GIF image. The malformed file contains frames that when parsed allocates a buffer for the first frame and then attempts to allocate buffers for the other frames. Using a size of zero in the subsequent frames the application doesn't have anything to allocate so it then attempts to free the buffer thus leading to the double-free memory corruption since there are multiple frames that require memory to be freed. Ease of Attack: Simple

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group