PT-2016-7565 · Huawei · Cloudengine 12800+1

Published 2016-12-21 · Updated 2018-03-26 · CVE-2016-8784

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Huawei CloudEngine 12800 versions V100R003C00 through V100R006C00

Description The issue is related to a memory leak that occurs when an unauthenticated attacker sends specific Label Distribution Protocol (LDP) packets to the devices. If the values of some parameters in the packet are abnormal, the LDP processing module fails to release the memory used to handle the packet, resulting in a memory leak.

Recommendations For versions V100R003C00 through V100R006C00, consider restricting access to the LDP processing module to minimize the risk of exploitation until a patch is available. As a temporary workaround, disabling the handling of abnormal LDP packets may also help mitigate the issue.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2016-8784

Affected Products

Cloudengine 12800

Huawei Vrp

References · 4

• https://osv.dev/vulnerability/CVE-2016-8784 · Vendor Advisory
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20161221-01-ldp-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8784 · Security Note
• http://securityfocus.com/bid/95079 · Note