Details of VAR-202010-1180

ID

VAR-202010-1180

CVE

CVE-2020-9087

TITLE

Taurus-AL00A Out-of-bounds read vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2020-012142

DESCRIPTION

Taurus-AL00A version 10.0.0.1(C00E1R1P1) has an out-of-bounds read vulnerability in XFRM module. An authenticated, local attacker may perform a specific operation to exploit this vulnerability. Due to insufficient validation of the parameters, which may be exploited to cause information leak. Taurus-AL00A Is vulnerable to an out-of-bounds read.Information may be obtained. Huawei Taurus-AL00A is a smart phone of China's Huawei (Huawei) company. The HUAWEI Taurus-AL00A XFRM module has security vulnerabilities. The vulnerability stems from the failure to fully verify the parameters

Trust: 2.25

sources: NVD: CVE-2020-9087 // JVNDB: JVNDB-2020-012142 // CNVD: CNVD-2020-57585 // VULMON: CVE-2020-9087

IOT TAXONOMY

category:

['IoT']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-57585

AFFECTED PRODUCTS

vendor:	huawei	model:	taurus-al00a	scope:	eq	version:	10.0.0.1\(c00e1r1p1\)	Trust: 1.0
vendor:	huawei	model:	taurus-al00a	scope:	eq	version:	-	Trust: 0.8
vendor:	huawei	model:	taurus-al00a	scope:	eq	version:	taurus-al00a firmware 10.0.0.1(c00e1r1p1)	Trust: 0.8
vendor:	huawei	model:	taurus-al00a 10.0.0.1	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2020-57585 // JVNDB: JVNDB-2020-012142 // NVD: CVE-2020-9087

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-9087
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2020-9087
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2020-57585
value:	LOW
Trust: 0.6
CNNVD:	CNNVD-202009-1683
value:	MEDIUM
Trust: 0.6
VULMON:	CVE-2020-9087
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2020-9087
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2020-57585
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2020-9087
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	1.8
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2020-9087
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-57585 // VULMON: CVE-2020-9087 // JVNDB: JVNDB-2020-012142 // CNNVD: CNNVD-202009-1683 // NVD: CVE-2020-9087

PROBLEMTYPE DATA

problemtype:	CWE-125	Trust: 1.0
problemtype:	Out-of-bounds read (CWE-125) [NVD Evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2020-012142 // NVD: CVE-2020-9087

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202009-1683

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202009-1683

PATCH

title:	huawei-sa-20200930-02-smartphone	url:	https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-02-smartphone-en	Trust: 0.8
title:	Patch for HUAWEI Taurus-AL00A information disclosure vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/236908	Trust: 0.6
title:	HUAWEI Taurus-AL00A Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=131162	Trust: 0.6

sources: CNVD: CNVD-2020-57585 // JVNDB: JVNDB-2020-012142 // CNNVD: CNNVD-202009-1683

EXTERNAL IDS

db:	NVD	id:	CVE-2020-9087	Trust: 3.1
db:	JVNDB	id:	JVNDB-2020-012142	Trust: 0.8
db:	CNVD	id:	CNVD-2020-57585	Trust: 0.6
db:	CNNVD	id:	CNNVD-202009-1683	Trust: 0.6
db:	VULMON	id:	CVE-2020-9087	Trust: 0.1

sources: CNVD: CNVD-2020-57585 // VULMON: CVE-2020-9087 // JVNDB: JVNDB-2020-012142 // CNNVD: CNNVD-202009-1683 // NVD: CVE-2020-9087

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2020-9087	Trust: 2.0
url:	https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-02-smartphone-en	Trust: 1.7
url:	https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20200930-02-smartphone-cn	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/125.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/189272	Trust: 0.1

sources: CNVD: CNVD-2020-57585 // VULMON: CVE-2020-9087 // JVNDB: JVNDB-2020-012142 // CNNVD: CNNVD-202009-1683 // NVD: CVE-2020-9087

SOURCES

db:	CNVD	id:	CNVD-2020-57585
db:	VULMON	id:	CVE-2020-9087
db:	JVNDB	id:	JVNDB-2020-012142
db:	CNNVD	id:	CNNVD-202009-1683
db:	NVD	id:	CVE-2020-9087

LAST UPDATE DATE

2024-11-23T21:58:59.038000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-57585	date:	2020-10-21T00:00:00
db:	VULMON	id:	CVE-2020-9087	date:	2020-10-16T00:00:00
db:	JVNDB	id:	JVNDB-2020-012142	date:	2021-04-26T07:54:00
db:	CNNVD	id:	CNNVD-202009-1683	date:	2020-10-21T00:00:00
db:	NVD	id:	CVE-2020-9087	date:	2024-11-21T05:39:59.873

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-57585	date:	2020-10-21T00:00:00
db:	VULMON	id:	CVE-2020-9087	date:	2020-10-12T00:00:00
db:	JVNDB	id:	JVNDB-2020-012142	date:	2021-04-26T00:00:00
db:	CNNVD	id:	CNNVD-202009-1683	date:	2020-09-30T00:00:00
db:	NVD	id:	CVE-2020-9087	date:	2020-10-12T14:15:14.027