PT-2016-7565 · Huawei · Cloudengine 12800+1

Publicado 2016-12-21 · Atualizado 2018-03-26 · CVE-2016-8784

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Huawei CloudEngine 12800 versions V100R003C00 through V100R006C00

Description The issue is related to a memory leak that occurs when an unauthenticated attacker sends specific Label Distribution Protocol (LDP) packets to the devices. If the values of some parameters in the packet are abnormal, the LDP processing module fails to release the memory used to handle the packet, resulting in a memory leak.

Recommendations For versions V100R003C00 through V100R006C00, consider restricting access to the LDP processing module to minimize the risk of exploitation until a patch is available. As a temporary workaround, disabling the handling of abnormal LDP packets may also help mitigate the issue.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2016-8784

Produtos afetados

Cloudengine 12800

Huawei Vrp

Referências · 4

• http://securityfocus.com/bid/95079 · Nota
• https://osv.dev/vulnerability/CVE-2016-8784 · Aviso do Fabricante
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20161221-01-ldp-en · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-8784 · Nota de Segurança