PT-2017-18217 · Huawei · Smc2.0

Published 2017-11-22 · Updated 2017-12-08 · CVE-2017-8213

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Huawei SMC2.0 versions V100R003C10, V100R005C00SPC100, V100R005C00SPC101B001T, V100R005C00SPC102, V100R005C00SPC103, V100R005C00SPC200, V100R005C00SPC201T, V500R002C00, V600R006C00

Description The issue is related to an input validation vulnerability when handling TLS and DTLS handshakes with certificates. Due to insufficient validation of received PKI certificates, remote attackers could exploit this to crash the TLS module.

Recommendations For Huawei SMC2.0 version V100R003C10, update to a fixed version to resolve the issue. For Huawei SMC2.0 version V100R005C00SPC100, update to a fixed version to resolve the issue. For Huawei SMC2.0 version V100R005C00SPC101B001T, update to a fixed version to resolve the issue. For Huawei SMC2.0 version V100R005C00SPC102, update to a fixed version to resolve the issue. For Huawei SMC2.0 version V100R005C00SPC103, update to a fixed version to resolve the issue. For Huawei SMC2.0 version V100R005C00SPC200, update to a fixed version to resolve the issue. For Huawei SMC2.0 version V100R005C00SPC201T, update to a fixed version to resolve the issue. For Huawei SMC2.0 version V500R002C00, update to a fixed version to resolve the issue. For Huawei SMC2.0 version V600R006C00, update to a fixed version to resolve the issue. As a temporary workaround, consider restricting the handling of TLS and DTLS handshakes with certificates until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2017-8213

Affected Products

Smc2.0

References · 3

• https://osv.dev/vulnerability/CVE-2017-8213 · Vendor Advisory
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20170705-01-tls-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8213 · Security Note