PT-2017-13986 · Huawei · Huawei Ireader

Published 2017-12-22 · Updated 2018-08-02 · CVE-2017-15309

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Huawei iReader app versions prior to 8.0.2.301

Description The issue is related to a path traversal vulnerability due to insufficient validation on file storage paths. This allows an attacker to store downloaded malicious files in an arbitrary directory, potentially leading to privilege escalation. There are also reports of a directory traversal file deletion vulnerability.

Recommendations For versions prior to 8.0.2.301, update to version 8.0.2.301 or later to resolve the issue. As a temporary workaround, consider restricting access to file storage paths to minimize the risk of exploitation. Avoid using the onChapPack directory in the affected Huawei Reader app until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-15309

ZDI-18-874

ZDI-18-878

Affected Products

Huawei Ireader

References · 5

• http://huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171120-01-hwreader-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15309 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-878 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-874 · Security Note
• https://osv.dev/vulnerability/CVE-2017-15309 · Vendor Advisory