1030 matches found
Security Advisory - App Lock Bypass Vulnerability in Huawei Mobile Phones
App Lock is a function provided by the Phone Manager app to prevent unauthorized use of apps on mobile phones. Some Huawei mobile phones have an App Lock bypass vulnerability. An attacker could perform specific operations to bypass the App Lock to use apps on a target mobile phone temporarily...
Security Advisory - Two Command Injection Vulnerabilities in The FusionSphere OpenStack
The FusionSphere has two command injection vulnerabilities due to the insufficient input validation on one port. An attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands. Vulnerability ID: HWPSIRT-2017-05142 and HWPSIRT-2017-05143 The tw...
Security Advisory - Lack of Signature Verification Vulnerability in Some Huawei APP
Some Huawei APP do not support signature verification for APK file. An attacker could exploit this vulnerability to hijack the APK and upload modified APK file. Successful exploit could lead to the APP is hijacking. Vulnerability ID: HWPSIRT-2017-07089 This vulnerability has been assigned a Commo...
Security Advisory - Integer Overflow Vulnerability in Some Huawei Products
There is an integer overflow vulnerability in some Huawei products. The attacker sends a response message to the device, which contains an illegal length field, it could produce an integer overflow and restart the modem system. Vulnerability ID: HWPSIRT-2017-06005 This vulnerability has been...
Security Advisory - Arbitrary Memory Write Vulnerability in Some Huawei Smart Phones
The boot loaders of some Huawei mobile phones have a arbitrary memory write vulnerability due to the lack of parameter validation. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify specific data to cause arbitrary memory...
Security Advisory - Authentication Bypass Vulnerability in Huawei Honor 5S Smart Phones
Huawei Honor 5S smart phones have an authentication bypass vulnerability due to the improper design of some components. An attacker can get a user's smart phone and install malicious apps in the mobile phone, allowing the attacker to reset the password and fingerprint of the phone without...
Security Advisory - Out-of-Bounds Memory Access Vulnerability in the Boot Loaders of Huawei Mobile Phones
The boot loaders of some Huawei mobile phones have an out-of-bounds memory access vulnerability due to the lack of parameter validation. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify specific data to cause buffer...
Security Advisory - Two Vulnerabilities in Smart Phones
Some Huawei smart phones have an unlock code verification bypassing vulnerability. An attacker with the root privilege of a mobile can exploit this vulnerability to bypass the unlock code verification and unlock the mobile phone bootloader. Vulnerability ID: HWPSIRT-2017-04121 This vulnerability...
Security Advisory - Information Disclosure Vulnerability in AEE extension of MTK Platform
There is an information disclosure vulnerability in AEE extension of MTK Platform used in Huawei smart phones. Due to improper privilege validation on specific processes, an attacker who tricks a user into installing a malicious application on the smart phone can exploit this vulnerability to...
Security Advisory - Weak Algorithm Vulnerability in Huawei USG product
There is a weak algorithm vulnerability in Huawei USGUSG6300/USG6600 products. Attackers may exploit the weak algorithm vulnerability to crack the cipher text and cause confidential information leaks on the transmission links. Vulnerability ID: HWPSIRT-2017-02028 This vulnerability has been...
Security Advisory - DoS Vulnerability in Some Huawei Smartphones
There is a denial of service DoS vulnerability in some Huawei Smartphones. An attacker tricks a user into installing a malicious application. Since the system does not verify the broadcasting message from the application, it could be exploited to cause some functions of system unavailable...
Security Advisory - DoS Vulnerability of Audio Driver in Some Huawei Smartphones
Audio driver has a denial of service DoS vulnerability in some Huawei smart phones. An attacker tricks a user into installing a malicious application on the smart phone, and the race condition cause null pointer accessing during the application access shared resource, which make the system reboot...
Security Advisory - Insufficient Input Validation Vulnerability in Bastet of Huawei Smart Phone
The Bastet of some Huawei mobile phones has an insufficient input validation vulnerability due to the lack of parameter validation. An attacker may trick a user into installing a malicious APP. The APP can modify specific parameter to cause system reboot. Vulnerability ID: HWPSIRT-2017-05190 This...
Security Advisory - 'Phoenix Talon' Vulnerabilities in Linux Kernel
The Linux operating system has four security vulnerabilities called 'Phoenix Talon', which affect Linux kernel 2.5.69 to Linux kernel 4.11. Successful exploit of these vulnerabilities can allow an attacker to launch DoS attacks and can lead to arbitrary code execution when certain conditions are...
Security Advisory - Multiple Buffer Overflow Vulnerabilities in Driver of Huawei Smart Phone
The driver of some Huawei smart phones have six buffer overflow vulnerabilities due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege of the Android system, the APP can send a specific parameter to the driver of the smart...
Security Advisory - BroadPwn Remote Code Execute Vulnerability
Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code via unspecified vectors, aka the "Broadpwn" issue. Successful exploit of this vulnerability could allow an attacker to remotely execute arbitrary code on affected devices. Vulnerability ID: HWPSIRT-2017-07072 This...
Security Advisory - Two DoS Vulnerabilities in Call Module of Some Huawei Smart Phones
There are two DoS vulnerabilities in the call module of some Huawei smart phones due to the lack of a parameters check. An attacker may trick a user into installing a malicious application, and the application can send given parameter to call module to crash the call and data communication proces...
Security Advisory - Resource Exhaustion Vulnerability in Some Huawei Smartphones
Some Huawei smartphones have a resource exhaustion vulnerability due to configure setting. An attacker tricks a user into installing a malicious application, the application may turn on the device flash-light and rapidly drain the device battery. Vulnerability ID: HWPSIRT-2017-04120 This...
Security Advisory - MaxAge LSA Vulnerability in OSPF Protocol of Some Huawei Products
Some Huawei products have a MaxAge LSA vulnerability due to improper OSPF implementation. When the device receives special LSA packets, the LS Link Status age would be set to MaxAge, 3600 seconds. An attacker can exploit this vulnerability to poison the route table and launch a DoS attack...
Security Notice - Statement on the article about “Devil's Ivy” Vulnerability published on WIRED
Huawei noticed that an article "Hack Brief: 'Devil's Ivy' Vulnerability Could Afflict Millions of IoT Devices" published at WIRED on July 18, 2017. The article mentioned that there was a vulnerability named "Devil's Ivy" CVE-2017-9765 in gSOAP. Huawei products are affacted by this vulnerability...
Security Advisory - FRP Bypass Vulnerability in Huawei Smart Phones
There is Factory Reset Protection FRP bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker can login the configuration flow by some secret code and can perform some operations to update the...
Security Advisory - Privilege Escalation Vulnerability in Push Module of Huawei Smart Phone
There is a privilege escalation vulnerability in Push module of Huawei Smart Phone. An attacker tricks a user to save a rich media into message on the smart phone, which could be exploited to cause the attacker to delete message or fake user to send message. Vulnerability ID: HWPSIRT-2017-05070...
Security Advisory - Directory Traversal Vulnerability in Push Module of Huawei Smart Phone
There is a directory traversal vulnerability in Push module of Huawei Smart Phone. Since the system does not verify the file name during decompression, system directories are traversed. It could be exploited to cause the attacker to replace files and impact the service. Vulnerability ID:...
Security Advisory - Escalation of Privilege Vulnerability in Intel AMT, Intel ISM and Intel SMT
Intel disclosed an escalation of privilege vulnerability in Intel Active Management Technology AMT, Intel Standard Manageability ISM, and Intel Small Business Technology in Security Center advisory INTEL-SA-00075. Unprivileged attackers could exploit this vulnerability to gain control of the...
Security Advisory - DoS Vulnerability in TLS of Some Huawei Products
There is a input validation vulnerability in some huawei products when handle TLS and DTLS handshake with certificate. Due to the insufficient validation of received PKI certificates, remote attackers could exploit this vulnerability to crash the TLS module. Vulnerability ID: HWPSIRT-2017-03121...
Security Advisory - DoS Vulnerability of isub Service in Some Huawei Smartphones
Isub service has a denial of service DoS vulnerability in some Huawei smart phones due to the input parameters validation. An attacker tricks a user into installing a malicious application on the smart phone, and the application can send given parameter to specific interface, which make a...
Security Advisory - DoS Vulnerability in Wi-Fi Driver of Some Huawei Smart Phones
There is a Denial of Service DoS vulnerability in Wi-Fi driver of some Huawei smart phones. An attacker may trick a user into installing a malicious application and the application can access invalid address of driver to crash the system. Vulnerability ID: HWPSIRT-2017-04153 This vulnerability ha...
Security Advisory - Multiple Vulnerabilities Released on Microsoft Security Advisory 4025685
Microsoft had released a Security Advisory 4025685 on June 14 to fix multiple critical security vulnerabilities in such systems as Microsoft Windows XP, Windows Server 2003, Windows VISTA, and Windows 8. Attackers can exploit these vulnerabilities to implement remote code execution or privilege...
Security Advisory - Use After Free Vulnerability in TEE Module of Some Huawei Smart Phones
The Trusted Execution Environment TEE module driver of some Huawei smart phones has a use after free UAF vulnerability. An attacker tricks a user into installing a malicious application, and the application can start multiple threads and try to create and free specific memory, which could trigger...
Security Advisory - Permission Control Vulnerability in Smart Phones
Some Huawei Smart phones have a permission control vulnerability. Due to improper authorization on specific processes, an attacker with the root privilege of a mobile Android system can exploit this vulnerability to obtain some information of the user. Vulnerability ID: HWPSIRT-2017-04123 This...
Security Advisory - Permission Control Vulnerability in Smart Phones
Some Huawei Smart phones have a permission control vulnerability. Due to improper authorization on specific processes, an attacker with the root privilege of a mobile Android system can exploit this vulnerability to obtain some information of the user. Vulnerability ID: HWPSIRT-2017-04123 This...
Security Advisory - Samba Remote Code Execution Vulnerability in Some Huawei Products
All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability, allowing an authenticated attacker to upload a shared library to a writable share and execute arbitrary code remotely on a targeted system. Samba 4.6.4, 4.5.10 and 4.4.14 have been issued as security...
Security Advisory - Multiple Vulnerabilities in UMA Products
The Unified Maintenance Audit UMA system provides a unified portal for O&M operations, controls and records users' O&M operations, and supports auditing by way of command display and video replay. The UMA product has the following vulnerabilities, which are introduced by software provided by...
Security Advisory - Memory Double Free Vulnerability in Touch Panel Driver of Some Huawei Smart Phones
The Touch Panel TP driver of some Huawei smart phones has a memory double free vulnerability. An attacker with the root privilege of the Android system tricks a user into installing a malicious application, and the application can start multiple threads and try to free specific memory, which coul...
Security Advisory - SQL Injection Vulnerability in the GaussDB
The GaussDB has a SQL injection vulnerability. An attacker with low privilege may inject some specific SQL to query or modify database files, causing database service abnormal. Vulnerability ID: HWPSIRT-2017-05017 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID:...
Security Advisory - Two Buffer Overflow Vulnerabilities in the GaussDB
GaussDB has a buffer overflow vulnerability. An authenticated, remote attacker could use a specially crafted string in an SQL query to cause the database to crash, or lead to privilege escalation. Vulnerability ID: HWPSIRT-2017-05016 This vulnerability has been assigned a Common Vulnerabilities a...
Security Advisory - Memory Double Free Vulnerability in Driver of Some Huawei Smart Phones
The soundtrigger driver of some Huawei smart phones has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can start multiple threads and try to free specific memory, which could triggers double free and causes a system crash...
Security Advisory - Multiple Security Vulnerabilities in HedEx product
HedExHuawei Electronic Documentation Explorer，Huawei electronic document browser, mainly used to browse Huawei products electronic documents. HedEx exist some vulnerabilities. HedEx has an arbitrary file download vulnerability. An attacker could exploit it to download arbitrary files on a target...
Security Advisory - Two Privilege Escalation Vulnerabilities in the GaussDB
There is a privilege escalation vulnerability in the validator functions of the GaussDB. An attacker may log in to the system as a low-privilege user and execute the high-privilege functions. Then, the attacker may obtain the high-privilege of the GaussDB and crash the system. Vulnerability ID:...
Security Advisory - Two Buffer Overflow Vulnerabilities in the GaussDB
There is a buffer overflow vulnerability in the type conversion function of the GaussDB. An attacker logs in to the system as a common user and craft malformed packets, which could be exploited to perform a denial of service attack or possibly remote code execution on the GaussDB. Vulnerability I...
Security Advisory - Buffer Overflow Vulnerability in The GaussDB
There is a buffer overflow vulnerability in the handling code for regular expressions on GaussDB. An authenticated, remote attacker could use a specially crafted regular expression to cause GaussDB to crash or possibly execute arbitrary code. Vulnerability ID: HWPSIRT-2017-05046 This vulnerabilit...
Security Advisory - Four Command Injection Vulnerabilities in The FusionSphere OpenStack
The FusionSphere OpenStack has four command injection vulnerabilities due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands. Vulnerability ID:...
Security Advisory - Command Injection Vulnerability in the NetEco
Huawei iManager NetEco has a command injection vulnerability due to insufficient input validation. An authenticated, remote attacker could exploit this vulnerability to send malicious packets to a target device. Successful exploit could enable a low privileged user to execute commands that a high...
Security Advisory - Command Injection Vulnerability in the GaussDB
The GaussDB has a command injection vulnerability. Due to the lack of input validation on some parameters, an attacker with low privilege may inject some specific command to modify database files, causing database service abnormal. Vulnerability ID: HWPSIRT-2017-05043 This vulnerability has been...
Security Advisory - Authentication Bypass Vulnerability in the Backup Function of GaussDB
The backup function of GaussDB has an authentication bypass vulnerability. An attacker with low privilege may bypass the authentication of the backup function of database to start or stop the backup function, causing the backup function abnormal. Vulnerability ID: HWPSIRT-2017-05044 This...
Security Advisory - Multiple Vulnerabilities in MTK Platform
There are multiple vulnerabilities in the graphics driver of MTK platform in Huawei smart phones. The graphics driver has two buffer overflow vulnerabilities due to the insufficient input verification. An attacker tricks a user into installing a malicious application which has the system privileg...
Security Advisory - FRP Bypass Vulnerability in Huawei Smart Phones
There is Factory Reset Protection FRP bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker can perform some operations to update the Google account. As a result, the FRP function is bypassed...
Security Advisory - DoS Vulnerability in Some Huawei Products
There is a DoS Vulnerability in some Huawei products. Due to the lack of adequate input validation, the attacker can send malformed packets to the device, which causes the device memory leaks, leading to DoS attacks. Vulnerability ID: HWPSIRT-2017-02118 This vulnerability has been assigned a Comm...
Security Advisory - 'WannaCry ransomware' Vulnerabilities in Microsoft Windows Systems
Huawei noticed that the WannaCry ransomware targeting at Windows exploits multiple vulnerabilities in Windows Server Message Block v1 SMBv1. These vulnerabilities were disclosed by Microsoft in Microsoft security bulletin MS17-010 on March 14. Successful exploit of these vulnerabilities could all...
Security Advisory - Three OpenSSL Vulnerabilities in Huawei Products
On January 26, 2017, the OpenSSL Software Foundation released a security advisory that included three new vulnerabilities. If a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client...