PT-2016-7563 · Huawei · Huawei Secospace Usg6600+3

Publicado 2016-12-14 · Atualizado 2017-04-05 · CVE-2016-8781

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Huawei Secospace USG6300 versions V500R001C20 through V500R001C20SPC200PWE Huawei Secospace USG6500 version V500R001C20 Huawei Secospace USG6600 versions V500R001C20 through V500R001C20SPC200PWE

Description A denial of service (DoS) issue exists due to the lack of memory release after executing a specific command. Remote attackers with specific permission can log in to a device and deliver a large number of such commands to exhaust memory, causing a DoS condition.

Recommendations For Huawei Secospace USG6300 versions V500R001C20 through V500R001C20SPC200PWE, restrict access to the device to prevent remote attackers from delivering a large number of commands. For Huawei Secospace USG6500 version V500R001C20, limit the number of commands that can be executed by a user with specific permission to prevent memory exhaustion. For Huawei Secospace USG6600 versions V500R001C20 through V500R001C20SPC200PWE, consider implementing a mechanism to release memory after command execution to prevent DoS conditions.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2016-8781

Produtos afetados

Huawei Secospace Usg6300

Huawei Secospace Usg6500

Huawei Secospace Usg6600

Huawei Vrp

Referências · 4

• http://huawei.com/en/psirt/security-advisories/huawei-sa-20161214-01-firewall-en · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-8781 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-8781 · Nota de Segurança
• http://securityfocus.com/bid/94927 · Nota