Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls
A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec.
A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec.
Telegram fixed the flaw in version 12.10.4 of the app, released in late September, and NebuSec disclosed it on October 29 .
The flaw can be triggered in every version from 8.6.2 through 12.10.3, NebuSec's co-founder and chief executive said in an email to The Hacker News.
The company confirmed it in private phone calls on ARM64-based phones and has no evidence so far that it directly affects Telegram's iOS and desktop apps or group calls.
The Hacker News has asked NebuSec and Telegram whether the flaw was used in real attacks, and asked NebuSec what an attacker's code could reach on a phone.
Anyone using Telegram for Android should make sure the app is on version 12.10.4 or later; the version number appears at the bottom of the app's Settings page.
That code did not handle missing fields correctly and accessed memory it should not, according to NebuSec, and whether the earlier code could be exploited in those apps has not been shown.
Telegram's published source code for version 12.10.3 contains a flaw that matches that description, a review by The Hacker News found, and the calling code that uses this message was switched on in version 8.6.2, the first version NebuSec names.
Telegram's iOS source code included that change from version 12.7 , released in May, and the desktop app's code from version 7.0.1 , released in July.
One type, called MediaState, reports whether the microphone is muted, whether the camera is on, and how the video is rotated; when a MediaState message included a rotation value, the code checked that value.
Separately, the Zero Day Initiative (ZDI) published an advisory on October 15 about an unpatched flaw in rlottie, the library Telegram apps have used to draw animated stickers.
Telegram had told ZDI in March that checks on its servers mitigated the flaw, and in April asked ZDI for a full remote code execution chain.
What happened
A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec.
Telegram fixed the flaw in version 12.10.4 of the app, released in late September, and NebuSec disclosed it on October 29 .
The flaw can be triggered in every version from 8.6.2 through 12.10.3, NebuSec's co-founder and chief executive said in an email to The Hacker News.
What changed
The company confirmed it in private phone calls on ARM64-based phones and has no evidence so far that it directly affects Telegram's iOS and desktop apps or group calls.
The Hacker News has asked NebuSec and Telegram whether the flaw was used in real attacks, and asked NebuSec what an attacker's code could reach on a phone.
Who is affected
Anyone using Telegram for Android should make sure the app is on version 12.10.4 or later; the version number appears at the bottom of the app's Settings page.
Why it matters
That code did not handle missing fields correctly and accessed memory it should not, according to NebuSec, and whether the earlier code could be exploited in those apps has not been shown.
Technical details
Telegram's published source code for version 12.10.3 contains a flaw that matches that description, a review by The Hacker News found, and the calling code that uses this message was switched on in version 8.6.2, the first version NebuSec names.
Telegram's iOS source code included that change from version 12.7 , released in May, and the desktop app's code from version 7.0.1 , released in July.
Response
One type, called MediaState, reports whether the microphone is muted, whether the camera is on, and how the video is rotated; when a MediaState message included a rotation value, the code checked that value.
What security teams should do
Separately, the Zero Day Initiative (ZDI) published an advisory on October 15 about an unpatched flaw in rlottie, the library Telegram apps have used to draw animated stickers.
Telegram had told ZDI in March that checks on its servers mitigated the flaw, and in April asked ZDI for a full remote code execution chain.
Attribution
The Hacker News: A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.