Security Advisory - Buffer Overflow Vulnerability in the FusionAccess
- SA No:Huawei-SA-20150909-01-FusionAccess
- Initial Release Date: 2015-09-09
- Last Release Date: 2015-09-09
FusionAccess is a kind of virtual desktop applications based on Huawei cloud platform. Through the deployment of Huawei desktop cloud software on the cloud platform, customers can access the cloud desktop by the thin client device or other devices.
There is a buffer overflow vulnerability in the product. An attacker could graft and send overlarge packet to exploit this vulnerability. This may cause login process suspended and result in user login failure (Vulnerability ID: HWPSIRT-2015-06004).
|
Product Name |
Affected Version |
Resolved Product and Version |
|
FusionAccess |
V100R005C10 |
Upgrade to V100R005C30 |
|
V100R005C20 |
Upgrade to V100R005C30 |
Exploiting this vulnerability may cause login process suspended and result in user login failure.
The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).
Base Score: 7.8 (AV:N/AC:L/Au:n/C:N/I:N/A:C)
Temporal Score: 6.4 (E:F/RL:O/RC:C)
1. Prerequisite:
The attacker gains access to the FusionAccess network.
2. Attacking procedure:
This vulnerability is due to insufficient input verification. An attacker could graft and send overlarge login message to exploit this vulnerability. This may cause login process suspended and result in user login failure.
Customers should contact Huawei TAC (Huawei Technical Assistance Center) to request the upgrades. For TAC contact information, please refer to Huawei worldwide website at http://www.huawei.com/en/psirt/report-vulnerabilities.
This vulnerability was found by Huawei internal tester. Huawei PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
2015-09-09 V1.0 INITIAL
None
Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.
To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.
To report a security vulnerability in Huawei products and solutions, please send it to PSIRT@huawei.com. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.
