PT-2017-14763 · Huawei · Huawei Ar3200+2

Published 2017-12-06 · Updated 2019-10-03 · CVE-2017-17330

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Huawei AR3200 versions V200R005C32 through V200R008C30 Huawei NGFW Module versions V500R001C00 through V500R002C00

Description The software has a memory leak issue due to improper release of allocated memory when parsing XML element data. An authenticated attacker can exploit this by uploading a crafted XML file, potentially causing system service abnormalities due to memory depletion.

Recommendations For Huawei AR3200 versions V200R005C32 through V200R008C30, update to a version that properly releases allocated memory when parsing XML element data to prevent memory leaks. For Huawei NGFW Module versions V500R001C00 through V500R002C00, update to a version that properly releases allocated memory when parsing XML element data to prevent memory leaks. As a temporary workaround, consider restricting access to XML file uploads until a patch is available.

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2017-17330

Affected Products

Huawei Ar3200

Huawei Ngfw Module

Huawei Vrp

References · 3

• https://osv.dev/vulnerability/CVE-2017-17330 · Vendor Advisory
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17330 · Security Note