PT-2014-8487 · Huawei · Huawei Mobile Partner

Published 2014-11-13 · Updated 2017-09-08 · CVE-2014-8359

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Huawei Mobile Partner for Windows version 23.009.05.03.1014

Description The issue allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse wintab32.dll in the Mobile Partner directory.

Recommendations For Huawei Mobile Partner for Windows version 23.009.05.03.1014, consider removing or restricting access to the wintab32.dll file in the Mobile Partner directory to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-8359

Affected Products

Huawei Mobile Partner

References · 7

• 🔥 http://packetstormsecurity.com/files/128767/Huawei-Mobile-Partner-DLL-Hijacking.html · Exploit
• 🔥 http://osandamalith.wordpress.com/2014/10/20/escalating-local-privileges-using-mobile-partner · Exploit
• 🔥 https://exploit-db.com/exploits/30477 · Exploit
• 🔥 http://securityfocus.com/bid/70671 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8359 · Security Note
• http://huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-376152.htm · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/97682 · Note