PT-2017-13992 · Huawei · Nip6300+4
Published
2017-11-29
·
Updated
2019-10-03
·
CVE-2017-15315
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Huawei NIP6300 versions V500R001C20SPC100 through V500R001C20SPC200
Huawei NIP6600 versions V500R001C20SPC100 through V500R001C20SPC200
Huawei Secospace USG6300 versions V500R001C20SPC100 through V500R001C20SPC200
Huawei Secospace USG6500 versions V500R001C20SPC100 through V500R001C20SPC200
Description
The issue is related to a memory leak vulnerability in the patch module of certain Huawei products. An authenticated attacker could exploit this by executing special commands multiple times, leading to memory leakage, which would eventually cause the device to reset.
Recommendations
For Huawei NIP6300 versions V500R001C20SPC100 through V500R001C20SPC200, update the patch module to a version that includes the fix for the memory leak vulnerability.
For Huawei NIP6600 versions V500R001C20SPC100 through V500R001C20SPC200, update the patch module to a version that includes the fix for the memory leak vulnerability.
For Huawei Secospace USG6300 versions V500R001C20SPC100 through V500R001C20SPC200, update the patch module to a version that includes the fix for the memory leak vulnerability.
For Huawei Secospace USG6500 versions V500R001C20SPC100 through V500R001C20SPC200, update the patch module to a version that includes the fix for the memory leak vulnerability.
As a temporary workaround, consider restricting the execution of special commands to minimize the risk of exploitation.
Fix
Missing Release of Resource after Effective Lifetime
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Huawei Vrp
Nip6300
Nip6600
Secospace Usg6300
Secospace Usg6500