Security Advisory - Privilege Escalation Vulnerability in Huawei Mate7
- SA No:Huawei-SA-20150211-01-smartphone
- Initial Release Date: Feb 11, 2015
- Last Release Date: Feb 11, 2015
Android versions earlier than 5.0 are affected by the vulnerability, which allows an attacker to escalate privilege. Huawei Mate7 is affected by the vulnerability (Vulnerability ID: HWPSIRT-2015-01043).
This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2014-7911
|
Prouct name |
Affected Versions |
Solved version |
|
MT7-TL10(Mate 7) |
V100R001CHNC00B122SP06 |
V100R001CHNC00B123SP03 |
Attackers can obtain the local user account and password.
The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).
Base Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Temporal Score: 5.9 (E:F/RL:OF/RC:C)
1. Prerequisite:
The mobile phone is connected to the computer through a cable;
2. Attacking procedure:
Before Android 5.0, java.io.ObjectInputStream does not check whether objects to be deserialized can be serialized. Attackers can exploit this vulnerability to execute arbitrary code in the system_server process through a malicious object and escalate his or her privilege.
This vulnerability was first disclosed by KEEN TEAM.
For security problems about Huawei products and solutions, please contactPSIRT@huawei.com.
For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.
2015-02-11 V1.0 INITIAL
None
