Lucene search

HuaweiCVE-2017-8202

HistoryNov 22, 2017 - 7:29 p.m.

CVE-2017-8202

2017-11-2219:29:05

CWE-119

huawei

web.nvd.nist.gov

cve-2017-8202

huawei

smart phone

cameraisp driver

buffer overflow

vulnerability

parameter validation

malicious app

system reboot

CVSS2

7.1

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:N/I:N/A:C

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

23.6%

JSON

The CameraISP driver of some Huawei smart phones with software of versions earlier than Prague-AL00AC00B205,versions earlier than Prague-AL00BC00B205,versions earlier than Prague-AL00CC00B205,versions earlier than Prague-TL00AC01B205,versions earlier than Prague-TL10AC01B205 has a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP, the APP can send a specific parameter to the CameraISP driver of the smart phone, causing system reboot.

Affected configurations

Nvd

Node

huaweiprague-al00a_firmwareRange<prague-al00ac00b205

AND

huaweiprague-al00aMatch-

Node

huaweiprague-al00b_firmwareRange<prague-al00bc00b205

AND

huaweiprague-al00bMatch-

Node

huaweiprague-al00c_firmwareRange<prague-al00cc00b205

AND

huaweiprague-al00cMatch-

Node

huaweiprague-tl00a_firmwareRange<prague-tl00ac01b205

AND

huaweiprague-tl00aMatch-

Node

huaweiprague-tl10a_firmwareRange<prague-tl10ac01b205

AND

huaweiprague-tl10aMatch-

VendorProductVersionCPE
huaweiprague-al00a_firmware*cpe:2.3:o:huawei:prague-al00a_firmware:*:*:*:*:*:*:*:*
huaweiprague-al00a-cpe:2.3:h:huawei:prague-al00a:-:*:*:*:*:*:*:*
huaweiprague-al00b_firmware*cpe:2.3:o:huawei:prague-al00b_firmware:*:*:*:*:*:*:*:*
huaweiprague-al00b-cpe:2.3:h:huawei:prague-al00b:-:*:*:*:*:*:*:*
huaweiprague-al00c_firmware*cpe:2.3:o:huawei:prague-al00c_firmware:*:*:*:*:*:*:*:*
huaweiprague-al00c-cpe:2.3:h:huawei:prague-al00c:-:*:*:*:*:*:*:*
huaweiprague-tl00a_firmware*cpe:2.3:o:huawei:prague-tl00a_firmware:*:*:*:*:*:*:*:*
huaweiprague-tl00a-cpe:2.3:h:huawei:prague-tl00a:-:*:*:*:*:*:*:*
huaweiprague-tl10a_firmware*cpe:2.3:o:huawei:prague-tl10a_firmware:*:*:*:*:*:*:*:*
huaweiprague-tl10a-cpe:2.3:h:huawei:prague-tl10a:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	prague-al00a_firmware	*	cpe:2.3:o:huawei:prague-al00a_firmware::::::::
huawei	prague-al00a	-	cpe:2.3:h:huawei:prague-al00a:-:::::::*
huawei	prague-al00b_firmware	*	cpe:2.3:o:huawei:prague-al00b_firmware::::::::
huawei	prague-al00b	-	cpe:2.3:h:huawei:prague-al00b:-:::::::*
huawei	prague-al00c_firmware	*	cpe:2.3:o:huawei:prague-al00c_firmware::::::::
huawei	prague-al00c	-	cpe:2.3:h:huawei:prague-al00c:-:::::::*
huawei	prague-tl00a_firmware	*	cpe:2.3:o:huawei:prague-tl00a_firmware::::::::
huawei	prague-tl00a	-	cpe:2.3:h:huawei:prague-tl00a:-:::::::*
huawei	prague-tl10a_firmware	*	cpe:2.3:o:huawei:prague-tl10a_firmware::::::::
huawei	prague-tl10a	-	cpe:2.3:h:huawei:prague-tl10a:-:::::::*

CNA Affected

[
  {
    "product": "Prague-AL00A,Prague-AL00B,Prague-AL00C,Prague-TL00A,Prague-TL10A",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Versions earlier than Prague-AL00AC00B205,Versions earlier than Prague-AL00BC00B205,Versions earlier than Prague-AL00CC00B205,Versions earlier than Prague-TL00AC01B205,Versions earlier than Prague-TL10AC01B205"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20171115-01-smartphone-en

www.securityfocus.com/bid/101959

CVSS2

7.1

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:N/I:N/A:C

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

23.6%

JSON

Related for CVE-2017-8202