cnvd - cnvd-2017-01861

cnvd-2017-01861

Vulnerability from cnvd

Title: Huawei Honor 7/Mate S手机主题应用权限提升漏洞

Description:

Honor 7和Mate S是中国华为（Huawei）公司的一款智能手机产品。

Huawei Honor 7/Mate S手机主题应用存在权限提升漏洞。由于应用未能对主题包进行检查，攻击者可利用漏洞上传带有恶意文件的主题包，并诱使用户安装，造成任意代码执行。

Severity: 中

Patch Name: Huawei Honor 7/Mate S手机主题应用权限提升漏洞的补丁

Patch Description:

Honor 7和Mate S是中国华为（Huawei）公司的一款智能手机产品。

Huawei Honor 7/Mate S手机主题应用存在权限提升漏洞。由于应用未能对主题包进行检查，攻击者可利用漏洞上传带有恶意文件的主题包，并诱使用户安装，造成任意代码执行。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

华为已发布版本修复该漏洞。安全预警链接： http://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20170222-01-theme-cn

Reference: http://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20170222-01-theme-cn

Impacted products

Name
['Huawei Honor 7 <PLK-UL00C17B385', 'Huawei Mate S <CRR-L09C432B380']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-2699"
    }
  },
  "description": "Honor 7\u548cMate S\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u667a\u80fd\u624b\u673a\u4ea7\u54c1\u3002\r\n\r\nHuawei Honor 7/Mate S\u624b\u673a\u4e3b\u9898\u5e94\u7528\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u7531\u4e8e\u5e94\u7528\u672a\u80fd\u5bf9\u4e3b\u9898\u5305\u8fdb\u884c\u68c0\u67e5\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u4e0a\u4f20\u5e26\u6709\u6076\u610f\u6587\u4ef6\u7684\u4e3b\u9898\u5305\uff0c\u5e76\u8bf1\u4f7f\u7528\u6237\u5b89\u88c5\uff0c\u9020\u6210\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002",
  "discovererName": "Nicky\uff08\u4f0d\u60e0\u5b87\uff09",
  "formalWay": "\u534e\u4e3a\u5df2\u53d1\u5e03\u7248\u672c\u4fee\u590d\u8be5\u6f0f\u6d1e\u3002\u5b89\u5168\u9884\u8b66\u94fe\u63a5\uff1a\r\nhttp://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20170222-01-theme-cn",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-01861",
  "openTime": "2017-02-23",
  "patchDescription": "Honor 7\u548cMate S\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u667a\u80fd\u624b\u673a\u4ea7\u54c1\u3002\r\n\r\nHuawei Honor 7/Mate S\u624b\u673a\u4e3b\u9898\u5e94\u7528\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u7531\u4e8e\u5e94\u7528\u672a\u80fd\u5bf9\u4e3b\u9898\u5305\u8fdb\u884c\u68c0\u67e5\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u4e0a\u4f20\u5e26\u6709\u6076\u610f\u6587\u4ef6\u7684\u4e3b\u9898\u5305\uff0c\u5e76\u8bf1\u4f7f\u7528\u6237\u5b89\u88c5\uff0c\u9020\u6210\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Huawei Honor 7/Mate S\u624b\u673a\u4e3b\u9898\u5e94\u7528\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Huawei Honor 7 \u003cPLK-UL00C17B385",
      "Huawei Mate S \u003cCRR-L09C432B380"
    ]
  },
  "referenceLink": "http://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20170222-01-theme-cn",
  "serverity": "\u4e2d",
  "submitTime": "2017-02-23",
  "title": "Huawei Honor 7/Mate S\u624b\u673a\u4e3b\u9898\u5e94\u7528\u6743\u9650\u63d0\u5347\u6f0f\u6d1e"
}

CVE-2017-2699 (GCVE-0-2017-2699)

Vulnerability from cvelistv5

Published

2017-11-22 19:00

Modified

2024-09-16 21:09

Severity ?

CWE

Privilege Elevation

Summary

The Huawei Themes APP in versions earlier than PLK-UL00C17B385, versions earlier than CRR-L09C432B380, versions earlier than LYO-L21C577B128 has a privilege elevation vulnerability. An attacker could exploit this vulnerability to upload theme packs containing malicious files and trick users into installing the theme packets, resulting in the execution of arbitrary code.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/96424	vdb-entry, x_refsource_BID
	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170222-01-theme-en	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Huawei Technologies Co., Ltd.	Honor 7, Mate S,LYO-L21	Version: Earlier than PLK-UL00C17B385 versions, Earlier than CRR-L09C432B380 versions, Earlier than LYO-L21C577B128 versions

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:02:07.420Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "96424",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/96424"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170222-01-theme-en"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Honor 7, Mate S,LYO-L21",
          "vendor": "Huawei Technologies Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "Earlier than PLK-UL00C17B385 versions, Earlier than CRR-L09C432B380 versions, Earlier than LYO-L21C577B128 versions"
            }
          ]
        }
      ],
      "datePublic": "2017-11-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Huawei Themes APP in versions earlier than PLK-UL00C17B385, versions earlier than CRR-L09C432B380, versions earlier than LYO-L21C577B128 has a privilege elevation vulnerability. An attacker could exploit this vulnerability to upload theme packs containing malicious files and trick users into installing the theme packets, resulting in the execution of arbitrary code."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Privilege Elevation",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-23T10:57:01",
        "orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
        "shortName": "huawei"
      },
      "references": [
        {
          "name": "96424",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/96424"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170222-01-theme-en"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@huawei.com",
          "DATE_PUBLIC": "2017-11-15T00:00:00",
          "ID": "CVE-2017-2699",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Honor 7, Mate S,LYO-L21",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Earlier than PLK-UL00C17B385 versions, Earlier than CRR-L09C432B380 versions, Earlier than LYO-L21C577B128 versions"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Huawei Technologies Co., Ltd."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Huawei Themes APP in versions earlier than PLK-UL00C17B385, versions earlier than CRR-L09C432B380, versions earlier than LYO-L21C577B128 has a privilege elevation vulnerability. An attacker could exploit this vulnerability to upload theme packs containing malicious files and trick users into installing the theme packets, resulting in the execution of arbitrary code."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Privilege Elevation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "96424",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/96424"
            },
            {
              "name": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170222-01-theme-en",
              "refsource": "CONFIRM",
              "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170222-01-theme-en"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
    "assignerShortName": "huawei",
    "cveId": "CVE-2017-2699",
    "datePublished": "2017-11-22T19:00:00Z",
    "dateReserved": "2016-12-01T00:00:00",
    "dateUpdated": "2024-09-16T21:09:01.447Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted