PT-2017-7877 · Telegram+1 · Telegram Desktop+1

Asarubboo · Published 2017-05-01 · Updated 2017-10-31 · CVE-2016-10351

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Telegram Desktop version 0.10.19

Description The issue allows local users to obtain sensitive authentication information via standard filesystem operations due to the use of 0755 permissions for the $HOME/.TelegramDesktop directory.

Recommendations For Telegram Desktop version 0.10.19, consider changing the permissions of the $HOME/.TelegramDesktop directory to more restrictive settings to prevent unauthorized access.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2017-2551

CVE-2016-10351

Affected Products

Alt Linux

Telegram Desktop

References · 9

• https://github.com/telegramdesktop/tdesktop/issues/2666 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-10351 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-10351 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10351 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10351 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10351 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-2551 · Vendor Advisory
• https://github.com/telegramdesktop/tdesktop/pull/3842/commits/388703b9ca1912a5438e37f9dd54c35805f2c594 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2016-10351 · Note