PT-2017-14738 · Huawei · Ar3200+17
Publicado
2017-12-13
·
Atualizado
2018-03-01
·
CVE-2017-17160
CVSS v2.0
7.1
Alta
| Vetor | AV:N/AC:M/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Huawei AR120-S versions V200R006C10 through V200R007C00
Huawei AR1200 versions V200R006C10 through V200R007C02
Huawei AR1200-S versions V200R006C10 through V200R008C20
Huawei AR150 versions V200R006C10 through V200R007C02
Huawei AR150-S versions V200R006C10 through V200R007C00
Huawei AR160 versions V200R006C10 through V200R007C02
Huawei AR200 versions V200R006C10 through V200R007C00
Huawei AR200-S versions V200R006C10 through V200R007C00
Huawei AR2200 versions V200R006C10 through V200R007C02
Huawei AR2200-S versions V200R006C10 through V200R008C20
Huawei AR3200 versions V200R006C10 through V200R007C02
Huawei AR3600 versions V200R006C10 through V200R007C00
Huawei AR510 versions V200R006C12 through V200R007C00
Huawei NetEngine16EX versions V200R006C10 through V200R007C00
Huawei SRG1300 versions V200R006C10 through V200R007C02
Huawei SRG2300 versions V200R006C10 through V200R007C02
Huawei SRG3300 versions V200R006C10 through V200R007C00
Description
The issue is caused by incomplete range checks of the input data, leading to a buffer overflow. An unauthenticated, remote attacker could exploit this by sending malicious IKE packets to the targeted device, potentially causing the device to write out of bounds and restart.
Recommendations
For Huawei AR120-S versions V200R006C10 through V200R007C00, update to a fixed version.
For Huawei AR1200 versions V200R006C10 through V200R007C02, update to a fixed version.
For Huawei AR1200-S versions V200R006C10 through V200R008C20, update to a fixed version.
For Huawei AR150 versions V200R006C10 through V200R007C02, update to a fixed version.
For Huawei AR150-S versions V200R006C10 through V200R007C00, update to a fixed version.
For Huawei AR160 versions V200R006C10 through V200R007C02, update to a fixed version.
For Huawei AR200 versions V200R006C10 through V200R007C00, update to a fixed version.
For Huawei AR200-S versions V200R006C10 through V200R007C00, update to a fixed version.
For Huawei AR2200 versions V200R006C10 through V200R007C02, update to a fixed version.
For Huawei AR2200-S versions V200R006C10 through V200R008C20, update to a fixed version.
For Huawei AR3200 versions V200R006C10 through V200R007C02, update to a fixed version.
For Huawei AR3600 versions V200R006C10 through V200R007C00, update to a fixed version.
For Huawei AR510 versions V200R006C12 through V200R007C00, update to a fixed version.
For Huawei NetEngine16EX versions V200R006C10 through V200R007C00, update to a fixed version.
For Huawei SRG1300 versions V200R006C10 through V200R007C02, update to a fixed version.
For Huawei SRG2300 versions V200R006C10 through V200R007C02, update to a fixed version.
For Huawei SRG3300 versions V200R006C10 through V200R007C00, update to a fixed version.
As a temporary workaround, consider restricting access to IKE packets until a patch is available.
Correção
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ar120-S
Ar1200
Ar1200-S
Ar150
Ar150-S
Ar160
Ar200
Ar200-S
Ar2200
Ar2200-S
Ar3200
Ar3600
Ar510
Huawei Vrp
Netengine16Ex
Srg1300
Srg2300
Srg3300