PT-2020-18674
CVE-2020-5753
·
تاريخ النشر
2020-05-20
·
تاريخ التحديث
2022-04-07
الوصف من
CVSS 3.1
5.3
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Signal Private Messenger Android versions 4.59.0 and up
Signal Private Messenger iOS versions 3.8.1.5 and up
Description
The issue allows a remote non-contact to ring a victim's Signal phone and disclose the currently used DNS server due to ICE Candidate handling before the call is answered or declined. This occurs because of improper handling of ICE candidates, which can lead to information disclosure about the victim's network setup.
Recommendations
For Signal Private Messenger Android versions 4.59.0 and up, consider disabling call functionality until a patch is available.
For Signal Private Messenger iOS versions 3.8.1.5 and up, restrict access to call features to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾