PT-2018-5796 · Huawei · Huawei Te60+3

Published 2018-02-15 · Updated 2018-02-22 · CVE-2017-15342

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Huawei DP300 version V500R002C00 Huawei TE60 version V600R006C00 Huawei TP3106 version V100R002C00 Huawei eSpace U1981 version V200R003C30SPC100

Description: The issue is related to a denial of service condition. It occurs because the software incorrectly calculates the remaining size in a buffer when handling SSL connections. A remote unauthenticated attacker could exploit this by sending a large number of crafted SSL messages to the device. Successful exploitation could lead to a denial of service due to insufficient space in the buffer.

Recommendations: For Huawei DP300 version V500R002C00, update the software to a version that correctly handles SSL connections to prevent denial of service. For Huawei TE60 version V600R006C00, apply a patch that fixes the buffer size calculation issue to mitigate the risk. For Huawei TP3106 version V100R002C00, restrict access to SSL connections until a software update is available that addresses the buffer size miscalculation. For Huawei eSpace U1981 version V200R003C30SPC100, consider disabling SSL connections temporarily as a workaround until a fixed version of the software is released.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-15342

Affected Products

Huawei Dp300

Huawei Te60

Huawei Tp3106

Huawei Espace U1981

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-15342 · Security Note
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20171206-01-ssl-en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-15342 · Vendor Advisory