PT-2018-6492 · Huawei · Te50+6

Publicado 2018-07-02 · Atualizado 2018-08-24 · CVE-2017-17317

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: Huawei USG6300 versions V100R001C10 through V100R001C30 Huawei USG6300 versions V500R001C00 through V500R001C50 Secospace USG6500 versions V100R001C10 through V100R001C30 Secospace USG6500 versions V500R001C00 through V500R001C50 Secospace USG6600 versions V100R001C00 through V100R001C30 Secospace USG6600 versions V500R001C00 through V500R001C50 TE30 versions V100R001C02 through V100R001C10 TE30 versions V500R002C00 through V600R006C00 TE40 versions V500R002C00 through V600R006C00 TE50 versions V500R002C00 through V600R006C00 TE60 versions V100R001C01 through V100R001C10 TE60 versions V500R002C00 through V600R006C00

Description: The issue is related to a buffer overflow vulnerability in the Common Open Policy Service Protocol (COPS) module. This vulnerability can be exploited by an unauthenticated, remote attacker who controls the peer device and sends specially crafted messages to the affected products. The root cause is insufficient input validation, which may lead to abnormal services if the exploit is successful.

Recommendations: For Huawei USG6300 versions V100R001C10 through V100R001C30, update to a version outside of this range to resolve the issue. For Huawei USG6300 versions V500R001C00 through V500R001C50, update to a version outside of this range to resolve the issue. For Secospace USG6500 versions V100R001C10 through V100R001C30, update to a version outside of this range to resolve the issue. For Secospace USG6500 versions V500R001C00 through V500R001C50, update to a version outside of this range to resolve the issue. For Secospace USG6600 versions V100R001C00 through V100R001C30, update to a version outside of this range to resolve the issue. For Secospace USG6600 versions V500R001C00 through V500R001C50, update to a version outside of this range to resolve the issue. For TE30 versions V100R001C02 through V100R001C10, update to a version outside of this range to resolve the issue. For TE30 versions V500R002C00 through V600R006C00, update to a version outside of this range to resolve the issue. For TE40 versions V500R002C00 through V600R006C00, update to a version outside of this range to resolve the issue. For TE50 versions V500R002C00 through V600R006C00, update to a version outside of this range to resolve the issue. For TE60 versions V100R001C01 through V100R001C10, update to a version outside of this range to resolve the issue. For TE60 versions V500R002C00 through V600R006C00, update to a version outside of this range to resolve the issue.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-17317

Produtos afetados

Huawei S6300

Secospace Usg6500

Secospace Usg6600

Te30

Te40

Te50

Te60

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-17317 · Nota de Segurança
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20180630-01-cops-en · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-17317 · Aviso do Fabricante