PT-2017-1615 · Telegram · Telegram Messenger

Publicado 2017-03-14 · Atualizado 2020-05-13 · CVE-2014-8688

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Telegram Messenger versions 1.8.2 through 2.6

Description The issue is related to the cleartext component of the Telegram Messenger instant messaging program, which lacks protection for service data. Exploitation of this issue may allow a remote attacker to access secret chat messages by reading the contents of memory segments used by the application. Secret chat messages are available in cleartext in process memory and a .db file.

Recommendations For versions 1.8.2 through 2.6, as a temporary workaround, consider restricting access to the memory segments used by the application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2017-00768

CVE-2014-8688

Produtos afetados

Telegram Messenger

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-8688 · Nota de Segurança
• https://blog.zimperium.com/telegram-hack · Nota
• https://bdu.fstec.ru/vul/2017-00768 · Nota de Segurança