PT-2017-18175 · Huawei · Huawei

Guang Gong + 2 · Publicado 2017-11-22 · Atualizado 2017-12-08 · CVE-2017-8169

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Huawei smart phones versions prior to VIE-L09C40B360

Description The issue is caused by a buffer overflow due to the lack of parameter validation. An attacker can trick a user into installing a malicious APP with root privilege, which can send a specific parameter to the smart phone, potentially causing the smartphone to restart or allowing arbitrary code execution.

Recommendations For versions prior to VIE-L09C40B360, update to version VIE-L09C40B360 or later to resolve the issue. As a temporary workaround, consider restricting the installation of APPs to minimize the risk of exploitation. Avoid using parameters that may trigger the buffer overflow until the issue is resolved.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-8169

Produtos afetados

Huawei

Referências · 3

• http://huawei.com/en/psirt/security-advisories/huawei-sa-20171025-01-overflow-en · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8169 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-8169 · Aviso do Fabricante