PT-2016-7472 · Huawei · Usg2100+4

Publicado 2016-09-14 · Atualizado 2016-10-04 · CVE-2016-8276

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Huawei USG2100, USG2200, USG5100, and USG5500 unified security gateways versions prior to V300R001C10SPC600

Description The issue is related to a buffer overflow in the Point-to-Point Protocol over Ethernet (PPPoE) module when Challenge Handshake Authentication Protocol (CHAP) authentication is configured on the server. This allows remote attackers to cause a denial of service (server restart) or execute arbitrary code via crafted packets sent during authentication.

Recommendations For versions prior to V300R001C10SPC600, update to V300R001C10SPC600 or later to resolve the issue. As a temporary workaround, consider disabling CHAP authentication on the server until a patch is available. Restrict access to the PPPoE module to minimize the risk of exploitation. Avoid using the PPPoE module for authentication until the issue is resolved.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2016-8276

Produtos afetados

Huawei Vrp

Usg2100

Usg2200

Usg5100

Usg5500

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-8276 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-8276 · Aviso do Fabricante
• http://securityfocus.com/bid/92962 · Nota
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20160914-01-usg-en · Aviso do Fabricante