Details of VAR-201810-0041

ID

VAR-201810-0041

CVE

CVE-2017-18308

TITLE

Snapdragon Mobile and Snapdragon Wear Access control vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-014325

DESCRIPTION

Modem segments are unlocked after authentication, leaving modem segments open to all in Snapdragon Mobile, Snapdragon Wear in version MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430. Snapdragon Mobile and Snapdragon Wear Contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Qualcomm MDM9607, etc. are the central processing unit (CPU) products of Qualcomm (Qualcomm) for different platforms. An access control error vulnerability exists in Core Services in several Qualcomm Snapdragon products. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements. The following products (for mobile and wearable devices) are affected: Qualcomm MDM9607; MSM8909W; SD 210; SD 212; SD 205; SD 425; SD 430

Trust: 1.8

sources: NVD: CVE-2017-18308 // JVNDB: JVNDB-2017-014325 // VULHUB: VHN-109417 // VULMON: CVE-2017-18308

AFFECTED PRODUCTS

vendor:	qualcomm	model:	sd 205	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	sd 210	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	sd 212	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	msm8909w	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	sd 430	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	sd 425	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	mdm9607	scope:	eq	version:	-	Trust: 1.6
vendor:	qualcomm	model:	mdm9607	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	msm8909w	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 205	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 210	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 212	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 425	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	sd 430	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2017-014325 // CNNVD: CNNVD-201810-1279 // NVD: CVE-2017-18308

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-18308
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-18308
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201810-1279
value:	HIGH
Trust: 0.6
VULHUB:	VHN-109417
value:	HIGH
Trust: 0.1
VULMON:	CVE-2017-18308
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2017-18308
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-109417
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-18308
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-109417 // VULMON: CVE-2017-18308 // JVNDB: JVNDB-2017-014325 // CNNVD: CNNVD-201810-1279 // NVD: CVE-2017-18308

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-284	Trust: 0.9

sources: VULHUB: VHN-109417 // JVNDB: JVNDB-2017-014325 // NVD: CVE-2017-18308

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201810-1279

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-201810-1279

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-014325

PATCH

title:	October 2018 Qualcomm Technologies, Inc. Security Bulletin	url:	https://www.qualcomm.com/company/product-security/bulletins	Trust: 0.8
title:	Multiple Qualcomm Snapdragon Product access control error vulnerability fixes	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=86351	Trust: 0.6
title:	Android Security Bulletins: Android Security Bulletin—August 2018	url:	https://vulmon.com/vendoradvisory?qidtp=android_security_bulletins&qid=746dc14fcd3f5e139648cfdc9d9039a9	Trust: 0.1
title:	SamsungReleaseNotes	url:	https://github.com/samreleasenotes/SamsungReleaseNotes	Trust: 0.1

sources: VULMON: CVE-2017-18308 // JVNDB: JVNDB-2017-014325 // CNNVD: CNNVD-201810-1279

EXTERNAL IDS

db:	NVD	id:	CVE-2017-18308	Trust: 2.6
db:	SECTRACK	id:	1041432	Trust: 1.8
db:	JVNDB	id:	JVNDB-2017-014325	Trust: 0.8
db:	CNNVD	id:	CNNVD-201810-1279	Trust: 0.7
db:	VULHUB	id:	VHN-109417	Trust: 0.1
db:	VULMON	id:	CVE-2017-18308	Trust: 0.1

sources: VULHUB: VHN-109417 // VULMON: CVE-2017-18308 // JVNDB: JVNDB-2017-014325 // CNNVD: CNNVD-201810-1279 // NVD: CVE-2017-18308

REFERENCES

url:	https://www.qualcomm.com/company/product-security/bulletins	Trust: 1.8
url:	http://www.securitytracker.com/id/1041432	Trust: 1.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-18308	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-18308	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://source.android.com/security/bulletin/2018-08-01.html	Trust: 0.1
url:	https://github.com/samreleasenotes/samsungreleasenotes	Trust: 0.1

sources: VULHUB: VHN-109417 // VULMON: CVE-2017-18308 // JVNDB: JVNDB-2017-014325 // CNNVD: CNNVD-201810-1279 // NVD: CVE-2017-18308

SOURCES

db:	VULHUB	id:	VHN-109417
db:	VULMON	id:	CVE-2017-18308
db:	JVNDB	id:	JVNDB-2017-014325
db:	CNNVD	id:	CNNVD-201810-1279
db:	NVD	id:	CVE-2017-18308

LAST UPDATE DATE

2024-11-23T20:02:42.047000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-109417	date:	2019-10-03T00:00:00
db:	VULMON	id:	CVE-2017-18308	date:	2019-10-03T00:00:00
db:	JVNDB	id:	JVNDB-2017-014325	date:	2019-01-25T00:00:00
db:	CNNVD	id:	CNNVD-201810-1279	date:	2019-10-23T00:00:00
db:	NVD	id:	CVE-2017-18308	date:	2024-11-21T03:19:49.303

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-109417	date:	2018-10-26T00:00:00
db:	VULMON	id:	CVE-2017-18308	date:	2018-10-26T00:00:00
db:	JVNDB	id:	JVNDB-2017-014325	date:	2019-01-25T00:00:00
db:	CNNVD	id:	CNNVD-201810-1279	date:	2018-10-29T00:00:00
db:	NVD	id:	CVE-2017-18308	date:	2018-10-26T13:29:00.357