Bug 1037007 (CVE-2016-10351) - [server:messaging/telegram-desktop]: CVE-2016-10351: telegram-desktop: insecure permission of $HOME/.TelegramDesktop directory
Summary: [server:messaging/telegram-desktop]: CVE-2016-10351: telegram-desktop: insecu...
Status: RESOLVED FIXED
Alias: CVE-2016-10351
Product: openSUSE Distribution
Classification: openSUSE
Component: Security (show other bugs)
Version: Leap 42.2
Hardware: Other Other
: P4 - Low : Normal (vote)
Target Milestone: ---
Assignee: Xu Zhao
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-05-01 12:55 UTC by Mikhail Kasimov
Modified: 2017-12-11 01:11 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Mikhail Kasimov 2017-05-01 12:55:59 UTC
Ref: https://blogs.gentoo.org/ago/2017/05/01/telegram-desktop-insecure-permission-of-home-telegramdesktop-directory/
===================================================
Description:
Telegram-desktop is the official desktop client for Telegram.

During the navigation of my filesystem I found the .TelegramDesktop with 755 permission:

drwxr-xr-x  4 ago  ago      4096 nov 23 14:30 .TelegramDesktop

Affected version:
At least from 0.10.19 to 1.0.29

Fixed version:
N/A

Commit fix:
N/A

Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.

CVE:
CVE-2016-10351

Timeline:
2016-11-23: bug discovered and reported to upstream
2017-05-01: blog post about the issue
2017-05-01: CVE assigned

Permalink:

    telegram-desktop: insecure permission of $HOME/.TelegramDesktop directory
===================================================

(open-)SUSE: https://software.opensuse.org/package/telegram-desktop

1.0.24 (TW, server:messaging repo)
1.0.14 (42.2, server:messaging repo)
0.9.56 (42.1, server:messaging repo)
Comment 1 Xu Zhao 2017-06-28 16:05:19 UTC
Progress: bug reported to upstream.
Here is the related github issue:
https://github.com/telegramdesktop/tdesktop/issues/2666

Waiting for upstream to fix it.
Comment 2 Xu Zhao 2017-09-28 18:14:59 UTC
Update: upstream has fixed the bug by setting the permission to 700.

For details, see:
https://github.com/telegramdesktop/tdesktop/issues/2666
as well as
https://github.com/telegramdesktop/tdesktop/pull/3842

This bug will be closed when the fix is merged to the next release and I will update the packaging in the server:messaging repository.
Comment 3 Xu Zhao 2017-12-11 01:11:37 UTC
Telegram Desktop in server:messaging repository has been upgraded to 1.1.29.
Bug fixed by upstream.