PT-2018-6431 · Huawei · Huawei Softco+4

Published 2018-07-03 · Updated 2018-10-12 · CVE-2017-17174

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Huawei RSE6500 version V500R002C00 Huawei SoftCo version V200R003C20SPCb00 Huawei VP9660 version V600R006C10 Huawei eSpace U1981 versions V100R001C20, V200R003C20, V200R003C30, V200R003C50

Description: The issue is related to a weak algorithm vulnerability. A remote, unauthenticated attacker can exploit this by capturing TLS traffic between clients and the affected products. The attacker may then launch the Bleichenbacher attack on RSA key exchange to decrypt the session key and previously captured sessions through some cryptanalytic operations. This could result in an information leak.

Recommendations: For Huawei RSE6500 version V500R002C00, consider disabling the RSA key exchange until a patch is available. For Huawei SoftCo version V200R003C20SPCb00, restrict access to TLS traffic to minimize the risk of exploitation. For Huawei VP9660 version V600R006C10, avoid using the affected RSA key exchange in the TLS protocol until the issue is resolved. For Huawei eSpace U1981 versions V100R001C20, V200R003C20, V200R003C30, V200R003C50, temporarily disable the use of the vulnerable algorithm as a quick mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2017-17174

Affected Products

Huawei Rse6500

Huawei Softco

Huawei Vp9660

Huawei Vrp

Huawei Espace U1981

References · 3

• http://huawei.com/en/psirt/security-advisories/huawei-sa-20180703-01-algorithm-en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-17174 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17174 · Security Note