1030 matches found
Security Advisory - Information Leak Vulnerability in Huawei FusionSphere Product
The open-source component Xenstore in the FusionSphere has an information leak vulnerability due to loose security settings. Successful exploit could allow an authenticated attacker to obtain partial information from virtual machines. Vulnerability ID: HWPSIRT-2016-06067. Huawei has released...
Security Advisory - Weak Encryption Algorithm Vulnerability in Huawei Servers
Some Huawei servers have a weak encryption algorithm vulnerability in the iBMC Intelligent Baseboard Management Controller. The software provide an option for users to select SSL encryption algorithms. If an insecure encryption algorithm is selected, an attacker may decrypt encrypted data, causin...
Security Notice - Statement About Toolkit Released by Shadow Brokers
On August 15, 2016, Huawei noticed that Shadow Brokers had released a toolkit claimed as from Equation Group on GitHub website, which includes exploit tools, scripts, and manuals targeting multiple Firewall vendors. Huawei Product Security Incident Response Team PSIRT started an investigation...
Security Advisory - XSS Vulnerability in Huawei OceanStor ISM
The OceanStor ISM is an integrated system management software product that allows users to manages CSS, view CSS alarms and some other types of basic information, and configure basic functions. The management interface of the OceanStor ISM has a XSS vulnerability because the system does not escap...
Security Advisory - Input Validation Vulnerability in Huawei Access Controllers
There is an input validation vulnerability in Huawei access controllers AC. Due to the lack of input validation, an attacker may craft malformed Control And Provisioning of Wireless Access Points CAPWAP protocol packets and send them to the device, causing the device to restart. Vulnerability ID:...
Security Advisory - HTTP Header Injection Vulnerability in Huawei FusionAccess
The FusionAccess is the desktop management system of Huawei FusionCloud desktop solution. Huawei FusionAccess has an HTTP header injection vulnerability. A remote, unauthenticated attacker can exploit it to tamper with HTTP headers, causing users to access crafted URLs. Vulnerability ID:...
Security Advisory - Information Leak Vulnerability in Some Huawei Servers
Some Huawei servers have an information leak vulnerability. The servers allow users to select security encryption algorithms. If an insecure encryption algorithm is selected, an attacker may decrypt ciphertext data, causing information leaks. Vulnerability ID: HWPSIRT-2016-07019 This vulnerabilit...
Security Advisory - Brute Force Cracking Vulnerability in Huawei Servers
Huawei server has a brute-force cracking vulnerability due to the lack of authentication protection mechanisms. A remote attacker may obtain user passwords via a brute force attack. Vulnerability ID: HWPSIRT-2016-05247 This vulnerability has been assigned Common Vulnerabilities and Exposures CVE...
Security Advisory - Improper Input Validation Vulnerability in AnyMail
Huawei AnyMail has an improper input validation vulnerability when opening compressed email attachments. Successful exploit could cause AnyMail to crash and exit. Vulnerability ID: HWPSIRT-2016-06099 This vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID: CVE-2016-6826...
Security Advisory - Cleartext Storage of Crytographic Key Vulnerability in FusionCompute
FusionCompute has a key cleartext storage vulnerability. Successful exploit could allow an attacker to obtain AES keys. Vulnerability ID: HWPSIRT-2016-06076 This vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID: CVE-2016-6827. Huawei has released software updates to fix...
Security Advisory - Buffer Overflow Vulnerability in Huawei USG Products
The Authentication, Authorization and Accounting AAA module in the USG products has a buffer overflow vulnerability. A remote attacker can send crafted Enterprise Application Platform EAP packets to the USG products through a Remote Authentication Dial In User Service RADIUS server which has...
Security Advisory - A Security Vulnerability of Using Insecure Random Numbers to Generate Self-signed Certificates in Huawei Products
Some Huawei products automatically generate self-signed certificates upon the first use. The random numbers used to generate these certificates are not random enough. Different devices' certificates may use the same random number consequently, which contains the risk of an attacker compromising t...
Security Advisory - A Security Vulnerability of Using Insecure Random Numbers to Generate Self-signed Certificates in Huawei Products
Some Huawei products automatically generate self-signed certificates upon the first use. The random numbers used to generate these certificates are not random enough. Different devices' certificates may use the same random number consequently, which contains the risk of an attacker compromising t...
Security Advisory - Input Validation Vulnerabilities in Camera Driver of Huawei Smart Phones
There are five input validation vulnerabilities in the Camera driver of some Huawei smart phones. An attacker may trick a user into installing a malicious application, and the application can send given parameter to Camera driver to crash the system or escalate user privilege. Vulnerability ID:...
Security Advisory - Input Validation Vulnerability in Huawei Routers
There is an input validation vulnerability in Huawei access routers, an attacker may exploit this vulnerability by crafting a malformed packet and sending it to the device. An exploit could allow the attacker to cause a Denial of Service or remote code execution. Vulnerability ID:...
Security Advisory - Input Validation Vulnerability in Multiple Huawei Products
There is an input validation vulnerability in Huawei multiple products, an attacker with control plane access may exploit this vulnerability by crafting a malformed packet. An exploit could allow the attacker to cause a Denial of Service or execute arbitrary code. Vulnerability ID:...
Security Advisory - Input Validation Vulnerability in WiFi Driver of Huawei Smart Phone
There is an input validation vulnerability in the WiFi driver of some Huawei products. An attacker may trick a user into installing a malicious application, and the application can send given parameter to WiFi driver to crash the system or escalate user privilege. Vulnerability ID:...
Security Advisory - Two Buffer Overflow Vulnerabilities in Wi-Fi Driver of Huawei Smart Phone
Wi-Fi driver of some Huawei products have two buffer overflow vulnerabilities due to the lack of a parameters check. An attacker may trick a user into installing a malicious application, and the application can send given parameter to Wi-Fi driver to crash the system or escalate user privilege...
Security Advisory - Multiple Vulnerabilities in OpenSSL in May 2016
On May 3, 2016, the OpenSSL Software Foundation released a security advisory that included six vulnerabilities. Of the six vulnerabilities disclosed, four of them may cause memory corruption or excessive memory usage, one could allow a padding oracle attack to decrypt traffic when the connection...
Security Advisory - XSS Vulnerability in Huawei Public Cloud Solution
The Public Cloud Solution has a Cross-Site Scripting XSS vulnerability in volume backup service module. An attacker can insert special characters to modify server data. Vulnerability ID: HWPSIRT-2016-06017 This vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID:...
Security Advisory - Integer Overflow Vulnerability in the OceanStor 5800
The OceanStor 5800 V3 Storage Systems are mid-range storage products newly developed by Huawei. The OceanStor 5800 has an integer overflow vulnerability. An authenticated attacker may send massive abnormal Network File System NFS packets, causing an anomaly in specific disk arrays. Vulnerability...
Security Advisory - Data Leak Vulnerability in the FusionCompute
The FusionCompute is a cloud operating system OS. It virtualizes computing, storage, and network resources, and implements centralized management and scheduling of the virtual resources through a unified interface. Huawei FusionCompute has sensitive data leak vulnerability. An attacker can log in...
Security Advisory - Weak Encryption Vulnerability in the OceanStor ReplicationDirector
OceanStor ReplicationDirector is designed to manage disaster recovery DR service of data centers DC for enterprises. Huawei OceanStor ReplicationDirector has weak encryption vulnerability. An attacker may exploit it to craft server certificate signatures. Vulnerability ID: HWPSIRT-2016-05156 Huaw...
Security Advisory - DLL Hijacking Vulnerability on Huawei HiSuite
The HiSuite is mobile assistant software on PCs. This software contains a DLL hijacking vulnerability. This vulnerability exists due to some DLL file is loaded by HiSuite improperly. And it allows an attacker to load this DLL file of the attacker's choosing that could execute arbitrary code...
Security Advisory - DoS Vulnerability in the OceanStor 5800
The OceanStor 5800 Storage Systems are mid-range storage products newly developed by Huawei. Huawei Oceanstor 5800 has a DoS vulnerability. An attacker may send massive abnormal HTTP packets to the device. As a result, the HTTP service generates a high CPU usage, and the device denies services...
Security Advisory - Insufficient Input Validation Vulnerability in the FusionInsight
The FusionInsight has an insufficient input validation vulnerability. An attacker may exploit it to gain the root privilege of the Linux system where the software resides and control the operating system cluster. Vulnerability ID: HWPSIRT-2016-06010 This vulnerability has been assigned Common...
Security Advisory - Token Transmission in Plaintext Vulnerability in OceanStor Products
The OceanStor 5300 V3/5500 V3/5600 V3/5800 V3/6800 V3/ 18800 V3/18500 V3 are mid-range and high-end storage products newly developed by Huawei Technologies Co., Ltd Huawei for short. This series is ideal for processing existing storage applications and follows the future development trend of...
Security Advisory - Memory Leak Vulnerability in Several Huawei Products
There is a vulnerability in several Huawei devices: USG series, NGFW module, IPS module, NIP series and AntiDDoS8000. A memory leak vulnerability exists in these products. In hot standby networking where two devices are not directly connected, an attacker can craft a malformed packet, which...
Security Advisory - Memory Leak Vulnerability in Some Huawei Products
Some Huawei products have a memory leak vulnerability. When the packet processing module of the device processes abnormal Multiprotocol Label Switching MPLS packets sent by attackers, the module repeatedly applies for memory, resulting in memory exhaustion in persistent attacks. Vulnerability ID:...
Security Advisory - Several Vulnerabilities in Huawei Honor Routers
Huawei Honor routers do not verify some parameters. As a result, sensitive information may be displayed, causing the leak of sensitive information. Vulnerability ID: HWPSIRT-2016-05053 This vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID: CVE-2016-5367. Huawei Honor...
Security Advisory - Buffer Overflow Vulnerability in Some Videoconference Products
The VP9660, VP9650, and VP9630 are Multipoint Control Units MCUs. As the core devices in videoconferencing systems, they provide endpoint access and conferencing functions. The three devices use the same software, namely, HUAWEI VP9660. The RSE6500 is a multimedia video conferencing server with...
Security Advisory - Apache Struts2 Remote Code Execution Vulnerability in Huawei Products
Apache Struts2 released a remote code execution vulnerability in S2-032 on the official website,when Dynamic Method Invocation DMI is enabled, an exploit could allow the attacker to cause remote code execution.Vulnerability ID: HWPSIRT-2016-04052 This vulnerability has been assigned a Common...
Security Advisory - Information Leak Vulnerability in Huawei Smart Phones
Some Huawei smartphones have an information leak vulnerability due to improper security status verification. An attacker may use a rogue base station to obtain information about subscribers' signal strengths. Vulnerability ID: HWPSIRT-2015-12007 This vulnerability has been assigned Common...
Security Advisory - Multiple Vulnerabilities in Huawei Smart Phones
Huawei smart phones have two authentication bypass vulnerabilities. An attacker may tricks users into installing a malicious app, and the app could exploit these vulnerabilities to bypass the permission checks, controlling partial module functions Vulnerability ID: HWPSIRT-2016-03013, and deletin...
Security Advisory - Two Buffer Overflow Vulnerabilities in Wi-Fi Driver of Huawei Smart Phone
Wi-Fi driver of some Huawei products have two buffer overflow vulnerabilities due to the lack of a parameters check. An attacker may trick a user into installing a malicious application, and the application can send given parameter to Wi-Fi driver to crash the system or escalate user privilege...
Security Advisory - Buffer Overflow Vulnerability in Huawei Several Products
There is a vulnerability in several Huawei devices: USG series and NGFW Module. These products have a buffer overflow vulnerability in the Smart DNS function. An attacker may craft a malformed packet with illegitimate parameters, leading to denial of service or the potential execution of arbitrar...
Security Advisory - Buffer Overflow Vulnerability in Huawei Several Products
There is a vulnerability in several Huawei devices: USG series, NGFW Module, IPS Module, NIP series and AntiDDoS8000. These products have a buffer overflow vulnerability in the Application Specific Packet Filtering ASPF function. An attacker may craft a malformed packet with illegitimate...
Security Advisory - XSS Vulnerability in the Email App of Huawei Smartphone
There is a vulnerability due to the lack of output encoding for some particular characters in the email APP built in the affected Smart Phones. A successful exploitation of the vulnerability could allow an unauthenticated remote attacker to perform a cross-site scripting XSS attack and lead to...
Security Advisory - Input Validation Vulnerability in Multiple Huawei Products
There is an input validation vulnerability in Multiple Huawei products, when the debug switch on the device is enabled, an attacker with network access may exploit this vulnerability by crafting malformed DNS packets and sending them to the target device. As for the lacking of input validation, a...
Security Advisory - Permission Control Vulnerability in the HiSuite
The HiSuite is mobile assistant software on PCs. The HiSuite has a permission control vulnerability. An unauthenticated attacker who has access to the LAN could exploit the vulnerability to install any app on the mobile phone. Vulnerability ID: HWPSIRT-2016-03034 This vulnerability has been...
Security Advisory - Vulnerability of No SSL Certificate Validation in Huawei Wear App and Hilink APP
A vulnerability of no SSL certificate validation exists in Huawei Wear APP and Hilink APP. These APPs still load the web page when accessing a website whose SSL certificate has issues, which brings risks to users. Vulnerability ID: HWPSIRT-2016-03008 This vulnerability has been assigned a Common...
Security Advisory - Cross-Site Script Vulnerability in Policy Center
Huawei Policy Center dynamically allocates network resources in a unified manner, enabling the network to provide services with more agility. A cross-site scripting XSS vulnerability exists in Huawei Policy Center. The vulnerability is caused by incomplete input validation. An attacker with a...
Security Advisory - Input Validation Vulnerability in Huawei AR3200
There is an input validation vulnerability in Huawei AR3200, which allows an attacker who logs into the device to send malformed packets, causing the AR3200 occasionally restart and a Denial of Service. Vulnerability ID: HWPSIRT-2015-10047 This vulnerability has been assigned Common Vulnerabiliti...
Security Advisory - Integrity Protection Vulnerability in Huawei E3276s Products
The Huawei E3276s products have an integrity protection vulnerability. As a result, user communication can be intercepted, spoofed, and injected with traffic. Vulnerability ID: HWPSIRT-2016-02019 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2016-3676...
Security Advisory - DoS Vulnerability in Huawei S Series Switches
Multiple models of Huawei S series switches have a DoS vulnerability. When an attacker controls or impersonates a server connected to a switch, the attacker can send malicious attack packets to the switch to cause it to restart and make it unavailable. Vulnerability ID: HWPSIRT-2015-12022 This...
Security Advisory - DoS Vulnerability in FusionCompute
FusionCompute is a cloud OS software for virtualization of hardware resources and central management of virtual, service, and user resources. A DoS vulnerability exists in FusionCompute. An attacker can send abnormal packets as an ordinary user to exhaust system resources and make services...
Security Advisory - OpenSSL DROWN Security Vulnerability
OpenSSL official website released a security advisory about a high risk vulnerability dubbed DROWN CVE-2016-0800 on March 1st, 2016. The vulnerability is: Once SSLv2 is used, an attacker can capture packets or act as a man in the middle MIMT to obtain SSL session keys, decrypt encrypted traffic,...
Security Advisory - SQL Injection Vulnerability in Policy Center Product
Huawei Policy Center dynamically allocates network resources in a unified manner, enabling the network to provide services with more agility. The Policy Center has a SQL injection vulnerability. After logging in to the target device, a remote attacker could exploit this vulnerability by grafting...
Security Advisory - GNU Glibc Buffer Overflow Security Vulnerability
Google security research team disclosed a buffer overflow vulnerability in GNU C library glibc CVE-2015-7547 on February 16, 2016, remote attackers can exploit the vulnerability to execute arbitrary code on an affected device. Vulnerability ID: HWPSIRT-2016-02018 This vulnerability has been...
Security Advisory - GNU Glibc Buffer Overflow Security Vulnerability
Google security research team disclosed a buffer overflow vulnerability in GNU C library glibc CVE-2015-7547 on February 16, 2016, remote attackers can exploit the vulnerability to execute arbitrary code on an affected device. Vulnerability ID: HWPSIRT-2016-02018 This vulnerability has been...