PT-2015-7722 · Huawei · Usg2200+4

Published 2015-10-21 · Updated 2015-12-08 · CVE-2015-8084

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Huawei USG5500 versions prior to V300R001C10SPC600 Huawei USG2100 versions prior to V300R001C10SPC600 Huawei USG2200 versions prior to V300R001C10SPC600 Huawei USG5100 versions prior to V300R001C10SPC600

Description The issue allows remote attackers to cause a denial of service, resulting in a device reboot, via crafted DHCP packets when "DHCP Snooping" is enabled and either "option82 insert" or "option82 rebuild" is enabled on an interface. This occurs because the device is unable to parse specific DHCP packets correctly.

Recommendations For Huawei USG5500 versions prior to V300R001C10SPC600, update to V300R001C10SPC600 or later to resolve the issue. For Huawei USG2100 versions prior to V300R001C10SPC600, update to V300R001C10SPC600 or later to resolve the issue. For Huawei USG2200 versions prior to V300R001C10SPC600, update to V300R001C10SPC600 or later to resolve the issue. For Huawei USG5100 versions prior to V300R001C10SPC600, update to V300R001C10SPC600 or later to resolve the issue. As a temporary workaround, consider disabling the "DHCP Snooping" function or restricting the use of "option82 insert" or "option82 rebuild" on interfaces until a patch is available.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-8084

Affected Products

Huawei Vrp

Usg2100

Usg2200

Usg5100

Usg5500

References · 5

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8084 · Security Note
• http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-457916.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8084 · Security Note
• https://huawei.com/en/psirt/security-advisories/hw-457916 · Note
• http://securityfocus.com/bid/77300 · Note