CVE-2017-8184

MTK platform in Huawei smart phones with software of earlier than Nice-AL00C00B160 versions, earlier than Nice-AL10C00B140 versions has a any memory access vulnerability. An attacker tricks a user into installing a malicious application on the smart phone, and send given parameter to cause to any memory access vulnerabilities, leading to sensitive information leakage.

CVSS v3 5.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector : AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171115-01-mtk-en	Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171115-01-mtk-en	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:huawei:mtk_platform_smart_phone_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:huawei:mtk_platform_smart_phone:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:huawei:mtk_platform_smart_phone_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:huawei:mtk_platform_smart_phone:-:*:*:*:*:*:*:*

History

21 Nov 2024, 03:33

Type	Values Removed	Values Added
References	~~() http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171115-01-mtk-en - Vendor Advisory~~	() http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171115-01-mtk-en - Vendor Advisory

Information

Published : 2017-11-22 19:29

Updated : 2024-11-21 03:33

NVD link : CVE-2017-8184

Mitre link : CVE-2017-8184

CVE.ORG link : CVE-2017-8184

JSON object : View

Products Affected

huawei

mtk_platform_smart_phone
mtk_platform_smart_phone_firmware

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

{"id": "CVE-2017-8184", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2017-11-22T19:29:04.460", "references": [{"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171115-01-mtk-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}, {"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171115-01-mtk-en", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "MTK platform in Huawei smart phones with software of earlier than Nice-AL00C00B160 versions, earlier than Nice-AL10C00B140 versions has a any memory access vulnerability. An attacker tricks a user into installing a malicious application on the smart phone, and send given parameter to cause to any memory access vulnerabilities, leading to sensitive information leakage."}, {"lang": "es", "value": "La plataforma MTK en los smartphones Huawei con versiones de software anteriores a Nice-AL00C00B160 y Nice-AL10C00B140 tiene una vulnerabilidad de acceso a cualquier memoria. Un atacante podr\u00eda enga\u00f1ar a un usuario para que instale una aplicaci\u00f3n maliciosa en el smartphone y enviar un par\u00e1metro dado y as\u00ed provocar una vulnerabilidad de acceso a cualquier memoria, conduciendo a una fuga de informaci\u00f3n sensible."}], "lastModified": "2024-11-21T03:33:29.427", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:mtk_platform_smart_phone_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE20C519-375B-4F63-9C58-B21B555698C6", "versionEndExcluding": "nice-al10c00b140"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:mtk_platform_smart_phone:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "05921642-7BB4-4E98-8F6E-FEB142BD2B31"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:mtk_platform_smart_phone_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18483DD5-EF71-4072-9F15-F2C2D074D1EF", "versionEndExcluding": "nice-al00c00b160"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:mtk_platform_smart_phone:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "05921642-7BB4-4E98-8F6E-FEB142BD2B31"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}