Security Advisory - Some Huawei 4G LTE devices are exposed to a message replay vulnerability
- SA No:huawei-sa-20190529-01-replay
- Initial Release Date: 2019-05-29
- Last Release Date: 2019-05-29
This vulnerability has been assigned a CVE ID: CVE-2019-5307.
Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-replay-en
|
Product Name |
Affected Version |
Resolved Product and Version |
|
P30 |
The versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) |
ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) |
|
P30 Pro |
The versions before VOG-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) |
Upgrade to VOG-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) |
Data services are unavailable after users access the rogue base station. Therefore, replaying the GUTI reallocation command message brings forth no additional impact. After users move out of the rogue base station, GUTIs are reset to normal values.
It is stipulated in 3GPP standard that IMSIs can be transmitted in plaintext in certain conditions. Therefore, no additional impact is caused even if the Identity request message is replayed.
Base Score: 4.2 (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Temporal Score: 3.9 (E:F/RL:O/RC:C)
Overall Score: 3.9
A rogue base station has been constructed, and victims have accessed this station.
Vulnerability details:
Some Huawei 4G LTE devices are exposed to a message replay vulnerability. or the sake of better compatibility, these devices implement a less strict check on the NAS message sequence number (SN), specifically NAS COUNT. As a result, an attacker can construct a rogue base station and replay the GUTI reallocation command message in certain conditions to tamper with GUTIs, or replay the Identity request message to obtain IMSIs.
The product that supports automatic update will receive a system update prompt. You can install the update to fix the vulnerability.
None
Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.
To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.
To report a security vulnerability in Huawei products and solutions, please send it to PSIRT@huawei.com. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.
