PT-2019-8265 · Qualcomm · Qualcomm Snapdragon

Published 2019-01-18 · Updated 2019-01-28 · CVE-2017-18160

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions MDM9635M, MDM9645, MDM9650, MDM9655, MSM8909W, SD 835, SD 845, SD 850

Description The issue is related to the AGPS session failure in the GNSS module of Qualcomm Snapdragon mobile and wear devices. This failure occurs because the cyphersuites are hardcoded and require a manual update every time.

Recommendations For versions MDM9635M, MDM9645, MDM9650, MDM9655, MSM8909W, SD 835, SD 845, SD 850, update the cyphersuites manually to resolve the AGPS session failure issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2017-18160

Affected Products

Qualcomm Snapdragon

References · 3

• https://qualcomm.com/company/product-security/bulletins · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18160 · Security Note
• http://securityfocus.com/bid/106128 · Note