Security Advisory - Improper Access Control Vulnerability in Some Huawei OceanStor products

An attacker may exploit the vulnerability to query some information or cause some services abnormal.

The vulnerability classification has been performed by using the CVSSv3 scoring system (http://www.first.org/cvss/specification-document).

Base Score: 3.5 (AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L)

Temporal Score: 3.3 (E:F/RL:O/RC:C)

This vulnerability can be exploited only when the following conditions are present:

1. The attacker can access the LAN where the target device resides.

2. The affected device must support the virtual machine (VM) feature. (OceanStor 5300 V3 and later versions must have a single controller's memory of 32 GB or higher to support this feature.)

3. The affected device must enable the VM feature. (OceanStor 5300 V3 and later versions disable this feature by default.)

4. The attacker must have the administrator privilege and log in to the DeviceManager.

Vulnerability details:

Due to incorrectly restrict access to a resource, an attacker with high privilege may exploit the vulnerability to query some information or send specific message to cause some service abnormal.

Customers should contact Huawei TAC (Huawei Technical Assistance Center) to request the upgrades. For TAC contact information, please refer to Huawei worldwide website at http://www.huawei.com/en/psirt/report-vulnerabilities.

This vulnerability was discovered by Huawei internal tester.

2017-11-25 V1.1 UPDATED Updated the "Software Versions and Fixes" section; Updated the information in "Summary" and "Technical Details";

2017-11-22 V1.0 INITIAL

None

Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.

To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.

To report a security vulnerability in Huawei products and solutions, please send it to PSIRT@huawei.com. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.