CVE-2019-18800 Information disclosure in n/a
Remote attackers can steal Viber accounts by intercepting unencrypted traffic to extract device identifiers and replaying them during registration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-18800?
CVE-2019-18800 is a high-severity vulnerability in n/a, published on 6 Nov 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffic is encrypted. TCP data packet 9 on port 4244 from the victim's device contains cleartext information such as the device model and OS version, IMSI, and 20 bytes of udid in a binary format, which is located at offset 0x14 of this packet. Then, the attacker installs Viber on his device, initiates the registration process for any phone number, but doesn't enter a pin from SMS. Instead, he closes Viber. Next, the attacker rewrites his udid with the victim's udid, modifying the viber_udid file, which is located in the Viber preferences folder. (The udid is stored in a hexadecimal format.) Finally, the attacker starts Viber again and enters the pin from SMS.
Which versions are affected by CVE-2019-18800?
It affects 1 product.
Products include Rakuten Viber.
How do I fix CVE-2019-18800?
No fix has been published for CVE-2019-18800 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-18800 being exploited?
There is no known exploitation of CVE-2019-18800 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-h624-wrj8-hr3r.