PT-2016-7472 · Huawei · Usg2100+4

Published 2016-09-14 · Updated 2016-10-04 · CVE-2016-8276

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Huawei USG2100, USG2200, USG5100, and USG5500 unified security gateways versions prior to V300R001C10SPC600

Description The issue is related to a buffer overflow in the Point-to-Point Protocol over Ethernet (PPPoE) module when Challenge Handshake Authentication Protocol (CHAP) authentication is configured on the server. This allows remote attackers to cause a denial of service (server restart) or execute arbitrary code via crafted packets sent during authentication.

Recommendations For versions prior to V300R001C10SPC600, update to V300R001C10SPC600 or later to resolve the issue. As a temporary workaround, consider disabling CHAP authentication on the server until a patch is available. Restrict access to the PPPoE module to minimize the risk of exploitation. Avoid using the PPPoE module for authentication until the issue is resolved.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2016-8276

Affected Products

Huawei Vrp

Usg2100

Usg2200

Usg5100

Usg5500

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-8276 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8276 · Vendor Advisory
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20160914-01-usg-en · Vendor Advisory
• http://securityfocus.com/bid/92962 · Note