Security Advisory - Multiple Injection Vulnerabilities in UDS

HWPSIRT-2014-1235 and HWPSIRT-2014-1237:

Successful exploitation of these vulnerabilities may cause information leaks.

HWPSIRT-2014-1236:

The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).

HWPSIRT-2014-1235:

Base Score: 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N)

Temporal Score: 2.1 (E:F/RL:O/RC:C)

HWPSIRT-2014-1236:

Base Score: 7.3 (AV:N/AC:H/Au:N/C:P/I:C/A:C)

Temporal Score: 6.0 (E:F/RL:O/RC:C)

HWPSIRT-2014-1237:

Base Score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)

HWPSIRT-2014-1235:

1. Prerequisite:

The attacker obtains and modifies the UDS patch.

The attacker gains access to the OceanStor UDS network;

2. Attacking procedure:

The attacker injects JavaScript into patch. After the patch is loaded through the OceanStor DeviceManager, the returned content contains the injected script. After the script is parsed and executed on the OceanStor DeviceManager, information leak occurs.

HWPSIRT-2014-1236:

1. Prerequisite:

The attacker obtains and modifies the UDS patch.

The attacker gains access to the OceanStor UDS network.

2. Attacking procedure:

The attacker injects shell scripts into patch files. After the patches are loaded by administrators, the injected shell will be executed under the root privilege.

HWPSIRT-2014-1237:

1. Prerequisite:

The attacker gains access to the OceanStor UDS network.

The attacker obtains the user name and password.

2. Attacking procedure:

For security problems about Huawei products and solutions, please contactPSIRT@huawei.com.

For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.

None