PT-2018-6403 · Huawei · Huawei Dp300+5

Published 2018-03-05 · Updated 2019-10-03 · CVE-2017-17131

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Medium

Base vector

AV:N/AC:M/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Huawei DP300 version V500R002C00 Huawei RP200 version V500R002C00 Huawei RP200 version V600R006C00 Huawei TE30 version V100R001C10 Huawei TE30 version V600R006C00 Huawei TE50 version V600R006C00 Huawei TE60 version V100R001C10 Huawei TE60 version V500R002C00 Huawei TE60 version V600R006C00 Huawei VP9660 version V500R002C10

Description: The issue arises due to insufficient validation of the parameter when a putty comment key is loaded, leading to a denial-of-service (DoS) condition. An authenticated remote attacker can exploit this by placing a malformed putty key file in the system, causing an infinite loop that results in the system rebooting.

Recommendations: For Huawei DP300 version V500R002C00, consider disabling the loading of putty comment keys until a patch is available. For Huawei RP200 version V500R002C00, restrict access to the system manager to minimize the risk of exploitation. For Huawei RP200 version V600R006C00, avoid using the putty key file feature in the system until the issue is resolved. For Huawei TE30 version V100R001C10, temporarily remove the putty comment key loading functionality to prevent the infinite loop. For Huawei TE30 version V600R006C00, restrict the ability to load putty key files to authorized personnel only. For Huawei TE50 version V600R006C00, consider implementing additional validation for putty comment keys to prevent malformed files from being loaded. For Huawei TE60 version V100R001C10, disable the putty key file loading feature until a fix is available. For Huawei TE60 version V500R002C00, restrict the use of the putty comment key loading feature to prevent exploitation. For Huawei TE60 version V600R006C00, avoid loading putty key files from untrusted sources until the issue is resolved. For Huawei VP9660 version V500R002C10, consider temporarily disabling the system manager's ability to load putty comment keys until a patch is available.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2017-17131

Affected Products

Huawei Dp300

Huawei Rp200

Huawei Te30

Huawei Te50

Huawei Te60

Huawei Vp9660

References · 3

• http://huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171206-01-vpp-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17131 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17131 · Vendor Advisory