PT-2017-14012 · Huawei · Huawei Te60+4

Publicado 2017-11-29 · Atualizado 2018-02-22 · CVE-2017-15341

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Huawei AR3200 versions V200R008C20 through V200R008C30 Huawei TE40 version V600R006C00 Huawei TE50 version V600R006C00 Huawei TE60 version V600R006C00

Description The issue is related to the improper decoding of X.509 certificates by the software. A remote unauthenticated attacker could exploit this by sending a crafted X.509 certificate to the device, potentially resulting in a denial of service on the device.

Recommendations For Huawei AR3200 versions V200R008C20 through V200R008C30, consider restricting access to the certificate decoding function until a patch is available. For Huawei TE40 version V600R006C00, avoid using the X.509 certificate decoding feature until the issue is resolved. For Huawei TE50 version V600R006C00, temporarily disable the X.509 certificate decoding functionality to minimize the risk of exploitation. For Huawei TE60 version V600R006C00, restrict the use of the X.509 certificate decoding module to prevent potential denial of service attacks.

Correção

DoS

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2017-15341

Produtos afetados

Huawei Ar3200

Huawei Te40

Huawei Te50

Huawei Te60

Huawei Vrp

Referências · 3

• http://huawei.com/en/psirt/security-advisories/huawei-sa-20171129-01-cert-en · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15341 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-15341 · Aviso do Fabricante