PT-2018-13079 · Telegram · Org.Telegram.Messenger

Boonpoj Thongakaraniroj + 1 · Publicado 2018-10-09 · Atualizado 2024-08-05 · CVE-2018-15543

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions org.telegram.messenger application version 4.8.11

Description An issue in the FingerprintManager class for Biometric validation allows authentication bypass through the callback method from onAuthenticationFailed to onAuthenticationSucceeded with null. This is because the fingerprint API in conjunction with the Android keyGenerator class is not implemented, allowing an attacker to authenticate with an arbitrary fingerprint. The vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred.

Recommendations For version 4.8.11, consider disabling the FingerprintManager class for Biometric validation as a temporary workaround until a patch is available. Restrict access to the onAuthenticationSucceeded and onAuthenticationFailed callback methods to minimize the risk of exploitation. Avoid using the fingerprint API in conjunction with the Android keyGenerator class until the issue is resolved.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2018-15543

Produtos afetados

Org.Telegram.Messenger

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-15543 · Nota de Segurança
• https://t.me/cvenotify/89170 · Publicação no Telegram
• https://gist.github.com/tanprathan/d286c0d5b02e344606287774304a1ccd · Nota
• https://osv.dev/vulnerability/CVE-2018-15543 · Aviso do Fabricante