Security Advisory - Remote Security Bypass Vulnerability on Huawei Android Devices
- SA No:Huawei-SA-20140821-Android
- Initial Release Date: Aug 21, 2014
- Last Release Date: Aug 21, 2014
Android version 4.1.1 - 4.4.2 is prone to a remote security bypass vulnerability (CVE-2013-6272):
A vulnerability in the Android system allows an attacker to initiate or terminate arbitrary calls without the call_phone permission.
After investigation， we confirm that some Huawei smartphone and tablet products are affected. (Vulnerability ID: HWPSIRT-2014-0717)
Successful exploitation of this vulnerability allows malware software to make or terminate arbitrary calls without informing users.
The severity of the vulnerabilities in this advisory has been assessed by the Common Vulnerability Scoring System Version 2.0 (http://www.first.org/cvss/).
Base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Temporal score: 4.1 (E:F/RL:O/RC:C)
|
Product Name |
Affected Version |
Solved version |
|
H30-L01/L02 |
V100R001 |
V100R001C00B136 |
|
H30-T00/ T10/ U10 |
V100R001 |
V100R001C00B145 |
|
G750-T00/ T01 |
V100R001 |
V100R001C00B145 |
|
G750-T20 |
V100R001 |
V100R001C00B120 |
Customers should contact Huawei TAC (Huawei Technical Assistance Center) to request the upgrades, or obtain them through Huawei worldwide website at http://support.huawei.com/support/.
For TAC contact information, please refer to the following links:
http://www.huaweidevice.com/resource/mini/201107199604/FAQ_ServiceHotline_en/index.html
http://www.huaweidevice.com/worldwide/netWorkPoint.do?method=index&directoryId=40
The vulnerability is reported by Wooyun.
For security problems about Huawei products and solutions, please contactPSIRT@huawei.com.
For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.
2014-08-21 V1.0 INITIAL
