SB20200716108 - Multiple vulnerabilities in some Huawei Products
Published: July 16, 2020 Updated: December 17, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2020-9102)
The vulnerability allows a local attacker to gain access to potentially sensitive information.
The vulnerability exists due to the improper management of the username. A local attacker can gain unauthorized access to sensitive information on the system.
2) Out-of-bounds read (CVE-ID: CVE-2020-9094)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition when a module does not deal with specific message properly. A remote attacker can send a malicious packet, trigger out-of-bounds read error and cause a denial of service condition on the system.
3) Improper Authentication (CVE-ID: CVE-2020-9207)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to a module does not verify the input file properly. A remote attacker can send specially crafted files to bypass current verification mechanism.
Remediation
Install update from vendor's website.