PT-2018-13079 · Telegram · Org.Telegram.Messenger

Boonpoj Thongakaraniroj + 1 · Published 2018-10-09 · Updated 2024-08-05 · CVE-2018-15543

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions org.telegram.messenger application version 4.8.11

Description An issue in the FingerprintManager class for Biometric validation allows authentication bypass through the callback method from onAuthenticationFailed to onAuthenticationSucceeded with null. This is because the fingerprint API in conjunction with the Android keyGenerator class is not implemented, allowing an attacker to authenticate with an arbitrary fingerprint. The vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred.

Recommendations For version 4.8.11, consider disabling the FingerprintManager class for Biometric validation as a temporary workaround until a patch is available. Restrict access to the onAuthenticationSucceeded and onAuthenticationFailed callback methods to minimize the risk of exploitation. Avoid using the fingerprint API in conjunction with the Android keyGenerator class until the issue is resolved.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-15543

Affected Products

Org.Telegram.Messenger

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-15543 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15543 · Vendor Advisory
• https://t.me/cvenotify/89170 · Telegram Post
• https://gist.github.com/tanprathan/d286c0d5b02e344606287774304a1ccd · Note