Sign-up

ID

VAR-201704-0436


CVE

CVE-2014-3222


TITLE

Huawei eSpace Meeting Vulnerabilities in authorization, authority and access control

Trust: 0.8

sources: JVNDB: JVNDB-2014-008243

DESCRIPTION

In Huawei eSpace Meeting with software V100R001C03SPC201 and the earlier versions, attackers that obtain the permissions assigned to common users can elevate privileges to access and set specific key resources. Huawei eSpace Meeting Contains vulnerabilities in authorization, authority, and access control.Information is acquired, information is falsified, and denial of service (DoS) An attack could be made. Huawei eSpace Meeting Service is a collaborative meeting solution from Huawei, a Chinese company. This solution integrates voice, video and data sharing, allowing users to access conferences simply and quickly through various terminals such as telephone terminals, desktop computers and tablet computers. A local elevation of privilege vulnerability exists in Huawei eSpace Meeting Service version 1.0.0.23. An attacker could use this vulnerability to gain elevated permissions. Huawei's eSpace Meeting solution fully meets the needs of enterprisecustomers for an integrated daily collaboration system by integrating theconference server, conference video terminal, conference user authorization,and teleconference.The application is vulnerable to an elevation of privileges vulnerabilitywhich can be used by a simple user that can change the executable file with abinary of choice. The vulnerability exist due to the improper permissions, withthe 'F' flag (full) for the 'Users' group, for the 'eMservice.exe' binary file.The service is installed by default to start on system boot with LocalSystemprivileges. Attackers can replace the binary with their rootkit, and on rebootthey get SYSTEM privileges.Tested on: Microsoft Windows 7 Professional SP1 (EN). The vulnerability is caused by the incorrect setting of user rights in the program

Trust: 2.61

sources: NVD: CVE-2014-3222 // JVNDB: JVNDB-2014-008243 // CNNVD: CNNVD-201403-569 // BID: 66107 // ZSL: ZSL-2014-5171 // VULHUB: VHN-71161

AFFECTED PRODUCTS

vendor:huaweimodel:espace meetingscope:lteversion:v100r001c03spc201

Trust: 1.8

vendor:huaweimodel:espace meetingscope:eqversion:v100r001c03spc201

Trust: 0.6

vendor:huaweimodel:espace meeting v100r001c03spc201b05scope: - version: -

Trust: 0.3

vendor:huaweimodel:espace meeting v100r001c03spc202scope:neversion: -

Trust: 0.3

vendor:huaweimodel:technologies espace meeting servicescope:eqversion:1.0.0.23 (v100r001c03spc201b050)

Trust: 0.1

sources: ZSL: ZSL-2014-5171 // BID: 66107 // JVNDB: JVNDB-2014-008243 // CNNVD: CNNVD-201704-214 // NVD: CVE-2014-3222

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-3222
value: HIGH

Trust: 1.0

NVD: CVE-2014-3222
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201704-214
value: MEDIUM

Trust: 0.6

ZSL: ZSL-2014-5171
value: (3/5)

Trust: 0.1

VULHUB: VHN-71161
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2014-3222
severity: MEDIUM
baseScore: 6.6
vectorString: AV:L/AC:M/AU:N/C:C/I:C/A:P
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: PARTIAL
exploitabilityScore: 3.4
impactScore: 9.5
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-71161
severity: MEDIUM
baseScore: 6.6
vectorString: AV:L/AC:M/AU:N/C:C/I:C/A:P
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: PARTIAL
exploitabilityScore: 3.4
impactScore: 9.5
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2014-3222
baseSeverity: HIGH
baseScore: 7.0
vectorString: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.0
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: ZSL: ZSL-2014-5171 // VULHUB: VHN-71161 // JVNDB: JVNDB-2014-008243 // CNNVD: CNNVD-201704-214 // NVD: CVE-2014-3222

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

sources: VULHUB: VHN-71161 // JVNDB: JVNDB-2014-008243 // NVD: CVE-2014-3222

THREAT TYPE

local

Trust: 1.5

sources: BID: 66107 // CNNVD: CNNVD-201704-214 // CNNVD: CNNVD-201403-569

TYPE

permissions and access control

Trust: 1.2

sources: CNNVD: CNNVD-201704-214 // CNNVD: CNNVD-201403-569

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-008243

EXPLOIT AVAILABILITY
sources:
            
            
            ZSL: ZSL-2014-5171 // 
            
            
            
            VULHUB: VHN-71161

PATCH
title:Huawei-SA-20140310-01url:http://www.huawei.com/en/psirt/security-advisories/hw-329170
Trust: 0.8
title:Huawei eSpace Meeting Service Fixes for permission permissions and access control vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=69060
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2014-008243 // 
            
            
            
            CNNVD: CNNVD-201704-214

EXTERNAL IDS
db:NVDid:CVE-2014-3222
Trust: 2.6
db:BIDid:66107
Trust: 1.0
db:JVNDBid:JVNDB-2014-008243
Trust: 0.8
db:CNNVDid:CNNVD-201704-214
Trust: 0.7
db:CNNVDid:CNNVD-201403-569
Trust: 0.6
db:ZSLid:ZSL-2014-5171
Trust: 0.4
db:EXPLOIT-DBid:32205
Trust: 0.2
db:CXSECURITYid:WLB-2014030081
Trust: 0.1
db:SECUNIAid:57225
Trust: 0.1
db:OSVDBid:104323
Trust: 0.1
db:PACKETSTORMid:125638
Trust: 0.1
db:SEEBUGid:SSVID-85505
Trust: 0.1
db:VULHUBid:VHN-71161
Trust: 0.1
sources:
            
            
            ZSL: ZSL-2014-5171 // 
            
            
            
            VULHUB: VHN-71161 // 
            
            
            
            BID: 66107 // 
            
            
            
            JVNDB: JVNDB-2014-008243 // 
            
            
            
            CNNVD: CNNVD-201704-214 // 
            
            
            
            CNNVD: CNNVD-201403-569 // 
            
            
            
            NVD: CVE-2014-3222

REFERENCES
url:http://www.huawei.com/en/psirt/security-advisories/hw-329170
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3222
Trust: 0.9
url:https://nvd.nist.gov/vuln/detail/cve-2014-3222
Trust: 0.9
url:http://www.securityfocus.com/bid/66107
Trust: 0.7
url:http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-329170.htm
Trust: 0.4
url:http://enterprise.huawei.com/en/solutions/multimediasolu/uc/hw-127541.htm
Trust: 0.3
url:http://www.huawei.com
Trust: 0.3
url:http://www.zeroscience.mk/en/vulnerabilities/zsl-2014-5171.php
Trust: 0.3
url:http://cxsecurity.com/issue/wlb-2014030081
Trust: 0.1
url:http://packetstormsecurity.com/files/125638
Trust: 0.1
url:http://secunia.com/advisories/57225/
Trust: 0.1
url:http://osvdb.org/show/osvdb/104323
Trust: 0.1
url:http://www.exploit-db.com/exploits/32205/
Trust: 0.1
sources:
            
            
            ZSL: ZSL-2014-5171 // 
            
            
            
            VULHUB: VHN-71161 // 
            
            
            
            BID: 66107 // 
            
            
            
            JVNDB: JVNDB-2014-008243 // 
            
            
            
            CNNVD: CNNVD-201704-214 // 
            
            
            
            CNNVD: CNNVD-201403-569 // 
            
            
            
            NVD: CVE-2014-3222

CREDITS
Gjoko Krstic
Trust: 0.9
sources:
            
            
            BID: 66107 // 
            
            
            
            CNNVD: CNNVD-201403-569

SOURCES
db:ZSLid:ZSL-2014-5171
db:VULHUBid:VHN-71161
db:BIDid:66107
db:JVNDBid:JVNDB-2014-008243
db:CNNVDid:CNNVD-201704-214
db:CNNVDid:CNNVD-201403-569
db:NVDid:CVE-2014-3222

LAST UPDATE DATE
2025-04-20T23:05:10.260000+00:00

SOURCES UPDATE DATE
db:ZSLid:ZSL-2014-5171date:2021-10-21T00:00:00
db:VULHUBid:VHN-71161date:2017-04-04T00:00:00
db:BIDid:66107date:2014-03-10T00:00:00
db:JVNDBid:JVNDB-2014-008243date:2017-04-28T00:00:00
db:CNNVDid:CNNVD-201704-214date:2017-04-06T00:00:00
db:CNNVDid:CNNVD-201403-569date:2014-04-01T00:00:00
db:NVDid:CVE-2014-3222date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:ZSLid:ZSL-2014-5171date:2014-03-10T00:00:00
db:VULHUBid:VHN-71161date:2017-04-02T00:00:00
db:BIDid:66107date:2014-03-10T00:00:00
db:JVNDBid:JVNDB-2014-008243date:2017-04-28T00:00:00
db:CNNVDid:CNNVD-201704-214date:2017-04-06T00:00:00
db:CNNVDid:CNNVD-201403-569date:2014-03-10T00:00:00
db:NVDid:CVE-2014-3222date:2017-04-02T20:59:00.203