PT-2017-14742 · Huawei · Quidway S5700+7

Published 2017-12-13 · Updated 2018-03-07 · CVE-2017-17165

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Huawei Quidway S2300 versions V200R003C00 through V200R009C00 Huawei Quidway S2700 versions V200R003C00SPC300 through V200R009C00 Huawei Quidway S5300 versions V200R003C00SPC300 through V200R009C00 Huawei Quidway S5700 versions V200R003C00SPC316T through V200R009C00 Huawei Quidway S600-E versions V200R008C00 through V200R009C00 Huawei Quidway S6300 versions V200R003C00 through V200R009C00 Huawei Quidway S6700 versions V200R003C00 through V200R009C00

Description The IPv6 function has an out-of-bounds read issue. An unauthenticated attacker can send crafted malformed IPv6 packets to the affected products. Due to insufficient verification of the packets, a successful exploit will cause the device to reset.

Recommendations For Huawei Quidway S2300 versions V200R003C00 through V200R009C00, update to a version that fixes the out-of-bounds read vulnerability in the IPv6 function. For Huawei Quidway S2700 versions V200R003C00SPC300 through V200R009C00, update to a version that fixes the out-of-bounds read vulnerability in the IPv6 function. For Huawei Quidway S5300 versions V200R003C00SPC300 through V200R009C00, update to a version that fixes the out-of-bounds read vulnerability in the IPv6 function. For Huawei Quidway S5700 versions V200R003C00SPC316T through V200R009C00, update to a version that fixes the out-of-bounds read vulnerability in the IPv6 function. For Huawei Quidway S600-E versions V200R008C00 through V200R009C00, update to a version that fixes the out-of-bounds read vulnerability in the IPv6 function. For Huawei Quidway S6300 versions V200R003C00 through V200R009C00, update to a version that fixes the out-of-bounds read vulnerability in the IPv6 function. For Huawei Quidway S6700 versions V200R003C00 through V200R009C00, update to a version that fixes the out-of-bounds read vulnerability in the IPv6 function.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2017-17165

Affected Products

Huawei Vrp

Quidway S2300

Quidway S2700

Quidway S5300

Quidway S5700

Quidway S600-E

Quidway S6300

Quidway S6700

References · 3

• http://huawei.com/en/psirt/security-advisories/huawei-sa-20171213-02-ipv6-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17165 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17165 · Vendor Advisory