PT-2017-14014 · Huawei · Nip6600+8

Publicado

2017-11-29

·

Atualizado

2018-02-26

·

CVE-2017-15348

CVSS v2.0

7.8

Alta

VetorAV:N/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions Huawei IPS Module version V500R001C00 NGFW Module version V500R001C00 NIP6300 version V500R001C00 NIP6600 version V500R001C00 Secospace USG6300 version V500R001C00 Secospace USG6500 version V500R001C00 Secospace USG6600 version V500R001C00 USG9500 version V500R001C00
Description The issue is related to insufficient input validation. An unauthenticated, remote attacker could send specific MPLS Echo Request messages to the target products. Due to insufficient input validation of some parameters in the messages, successful exploit may cause the device to reset.
Recommendations For Huawei IPS Module version V500R001C00, update to a fixed version to resolve the issue. For NGFW Module version V500R001C00, update to a fixed version to resolve the issue. For NIP6300 version V500R001C00, update to a fixed version to resolve the issue. For NIP6600 version V500R001C00, update to a fixed version to resolve the issue. For Secospace USG6300 version V500R001C00, update to a fixed version to resolve the issue. For Secospace USG6500 version V500R001C00, update to a fixed version to resolve the issue. For Secospace USG6600 version V500R001C00, update to a fixed version to resolve the issue. For USG9500 version V500R001C00, update to a fixed version to resolve the issue. As a temporary workaround, consider restricting access to the MPLS Echo Request messages until a patch is available.

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-15348

Produtos afetados

Huawei Ips Module
Huawei Vrp
Ngfw Module
Nip6300
Nip6600
Secospace Usg6300
Secospace Usg6500
Secospace Usg6600
Usg9500