PT-2018-6463 · Huawei · Huawei Mate 9 Pro

Publicado 2018-03-09 · Atualizado 2019-10-03 · CVE-2017-17279

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Huawei Mate 9 Pro smart phones with software versions prior to LON-AL00B 8.0.0.343(C00)

Description: The soundtrigger module has an authentication bypass issue due to improper design. An attacker can trick a user into installing a malicious application, which can exploit this issue to bypass authentication. Once exploited, the attacker can control the phone to send short messages and make calls within audio range to the phone.

Recommendations: For versions prior to LON-AL00B 8.0.0.343(C00), update to version LON-AL00B 8.0.0.343(C00) or later to resolve the issue. As a temporary workaround, consider restricting the installation of applications from untrusted sources to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2017-17279

Produtos afetados

Huawei Mate 9 Pro

Referências · 4

• http://securityfocus.com/bid/103360 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-17279 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-17279 · Aviso do Fabricante
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20180307-01-smartphone-en · Aviso do Fabricante