Signal Vulnerability Lets Malicious Callers Block Hang-Ups
Summary
A vulnerability in Signal's open-source RingRTC calling library allowed malicious callers to prevent calls from ending properly. This bug effectively allowed attackers to hang up on users, disrupting communication.
IFF Assessment
This vulnerability allows malicious actors to disrupt communications by preventing legitimate calls from ending, which is detrimental to users and the platform's reliability.
Severity
The vulnerability impacts the Confidentiality, Integrity, and Availability of the communication session, with an attack vector present on the network and requiring user interaction. The exploitability is moderate, and the impact on availability is significant as calls cannot be properly terminated.
Defender Context
This vulnerability highlights the importance of thoroughly vetting open-source components used in communication applications. Defenders should be aware of such flaws that could impact service availability and user experience, and ensure timely patching of affected libraries.