PT-2017-1615 · Telegram · Telegram Messenger

Published 2017-03-14 · Updated 2020-05-13 · CVE-2014-8688

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Telegram Messenger versions 1.8.2 through 2.6

Description The issue is related to the cleartext component of the Telegram Messenger instant messaging program, which lacks protection for service data. Exploitation of this issue may allow a remote attacker to access secret chat messages by reading the contents of memory segments used by the application. Secret chat messages are available in cleartext in process memory and a .db file.

Recommendations For versions 1.8.2 through 2.6, as a temporary workaround, consider restricting access to the memory segments used by the application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2017-00768

CVE-2014-8688

Affected Products

Telegram Messenger

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-8688 · Security Note
• https://bdu.fstec.ru/vul/2017-00768 · Security Note
• https://blog.zimperium.com/telegram-hack · Note