Security Advisory - Information Leak Vulnerability in Certain Huawei Products
- SA No:Huawei-SA-20150930-01-Routers
- Initial Release Date: 2015-09-30
- Last Release Date: 2017-04-19
Some Huawei products have two information leak vulnerabilities caused by improper encryption mechanisms.
Users can use reversible or irreversible encryption algorithms to encrypt passwords. If a reversible encryption algorithm is used to encrypt administrators' passwords, an attacker with high administrative privileges can log in to the device, obtain the ciphertext password of a higher-level administrator, and crack it to get elevated privileges. (Vulnerability ID: HWPSIRT-2015-06073)
This vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2015-8085.
Encryption keys are stored in the system. The attacker can implement reverse engineering to obtain the encryption keys. (Vulnerability ID: HWPSIRT-2015-06080)
This vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2015-8086.
After successful exploitation of the two vulnerabilities, the attacker can obtain plaintext passwords, leading to user information leaks.
Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:
http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-455876.htm
|
Product Name |
Affected Version |
Resolved Product and Version |
|
AR |
V200R001 |
Upgrade to V200R007C00SPC100 |
|
V200R002 |
||
|
V200R003 |
||
|
V200R005C10 |
||
|
V200R005C20 |
||
|
V200R005C30 |
||
|
Quidway S9300 |
V200R003C00SPC500 |
Upgrade to V200R009C00 |
|
V200R002C00SPC100 |
||
|
V200R001C00SPC300 |
||
|
S12700 |
V200R006C00 |
Upgrade to V200R008C00SPC500 |
|
V200R005C00 |
||
|
S9300 |
V200R006C00SPC500 |
Upgrade to V200R007C00 |
|
V200R005C00SPC300 |
||
|
Quidway S5300 |
V200R001C00SPC300 |
Upgrade to V200R007C00 |
|
S5700 |
V200R006C00 |
Upgrade to V200R007C00SPC500 |
|
V200R005C00 |
||
|
V200R003C00 |
||
|
V200R002C00 |
||
|
V200R001C00 |
||
|
S5300 |
V200R006C00SPC500 |
Upgrade to V200R007C00 |
|
V200R005C00SPC500 |
||
|
V200R002C00 |
HWPSIRT-2015-06073&HWPSIRT-2015-06080:
After successful exploitation of the two vulnerabilities, the attacker can obtain plaintext passwords, leading to user information leaks.
The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).
HWPSIRT-2015-06073
Base Score: 2.1 (AV:N/AC:H/Au:S/C:P/I:N/A:N)
Temporal Score: 1.7 (E:F/RL:O/RC:C)
HWPSIRT-2015-06080
Base Score: 2.1 (AV:N/AC:H/Au:S/C:P/I:N/A:N)
Temporal Score: 1.7 (E:F/RL:O/RC:C)
HWPSIRT-2015-06073&HWPSIRT-2015-06080:
1. Prerequisite:
The attacker has access to the network and obtains high administrative privileges;
2. Attacking procedure:
Users can use reversible or irreversible encryption algorithms to encrypt passwords. If a reversible encryption algorithm is used to encrypt administrators' passwords, an attacker with high administrative privileges can log in to the device, obtain the ciphertext password of a higher-level administrator, and crack it to get elevated privileges. (Vulnerability ID: HWPSIRT-2015-06073)
Encryption keys are stored in the system. The attacker can implement reverse engineering to obtain the encryption keys. (Vulnerability ID: HWPSIRT-2015-06080)
After successful exploitation of the two vulnerabilities, the attacker can obtain plaintext passwords, leading to user information leaks.
This vulnerability is reported by two Emaze researchers, Roberto Paleari and Aristide Fattori. Thanks for their attention on the vulnerabilities in Huawei products. Huawei PSIRT is not aware of any malicious use of the vulnerability described in this advisory.
For security problems about Huawei products and solutions, please contactPSIRT@huawei.com.
For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.
2017-04-19 V1.4 UPDATED Updated Summary and Technique Details
2016-09-07 V1.3 UPDATED Updated the "Software Versions and Fixes" section.
2015-11-11 V1.2 UPDATED Updated CVE IDs and Summary
2015-11-03 V1.1 UPDATED Updated the CVSS score
2015-09-30 V1.0 INITIAL
None
