PT-2018-6444 · Huawei · Ar3200+17

Published 2018-01-31 · Updated 2018-03-07 · CVE-2017-17202

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Huawei AR120-S versions V200R005C32 through V200R008C30 Huawei AR1200 versions V200R005C32 through V200R008C30 Huawei AR1200-S versions V200R005C32 through V200R008C30 Huawei AR150 versions V200R005C32 through V200R008C30 Huawei AR150-S versions V200R005C32 through V200R008C30 Huawei AR160 versions V200R005C32 through V200R008C30 Huawei AR200 versions V200R005C32 through V200R008C30 Huawei AR200-S versions V200R005C32 through V200R008C30 Huawei AR2200 versions V200R006C10 through V200R008C30 Huawei AR2200-S versions V200R005C32 through V200R008C30 Huawei AR3200 versions V200R005C32 through V200R008C30 Huawei AR3600 versions V200R006C10 through V200R008C20 Huawei AR510 versions V200R005C32 through V200R008C30 Huawei NetEngine16EX versions V200R005C32 through V200R008C30 Huawei SRG1300 versions V200R005C32 through V200R008C30 Huawei SRG2300 versions V200R005C32 through V200R008C30 Huawei SRG3300 versions V200R005C32 through V200R008C30

Description: The issue is caused by insufficient input validation, leading to an out-of-bounds read vulnerability. An unauthenticated, remote attacker could exploit this vulnerability by sending malformed Session Initiation Protocol (SIP) packets to the target device. Successful exploitation could cause the device to read out of bounds, resulting in a service being unavailable.

Recommendations: For Huawei AR120-S versions V200R005C32 through V200R008C30, update to a fixed version. For Huawei AR1200 versions V200R005C32 through V200R008C30, update to a fixed version. For Huawei AR1200-S versions V200R005C32 through V200R008C30, update to a fixed version. For Huawei AR150 versions V200R005C32 through V200R008C30, update to a fixed version. For Huawei AR150-S versions V200R005C32 through V200R008C30, update to a fixed version. For Huawei AR160 versions V200R005C32 through V200R008C30, update to a fixed version. For Huawei AR200 versions V200R005C32 through V200R008C30, update to a fixed version. For Huawei AR200-S versions V200R005C32 through V200R008C30, update to a fixed version. For Huawei AR2200 versions V200R006C10 through V200R008C30, update to a fixed version. For Huawei AR2200-S versions V200R005C32 through V200R008C30, update to a fixed version. For Huawei AR3200 versions V200R005C32 through V200R008C30, update to a fixed version. For Huawei AR3600 versions V200R006C10 through V200R008C20, update to a fixed version. For Huawei AR510 versions V200R005C32 through V200R008C30, update to a fixed version. For Huawei NetEngine16EX versions V200R005C32 through V200R008C30, update to a fixed version. For Huawei SRG1300 versions V200R005C32 through V200R008C30, update to a fixed version. For Huawei SRG2300 versions V200R005C32 through V200R008C30, update to a fixed version. For Huawei SRG3300 versions V200R005C32 through V200R008C30, update to a fixed version. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2017-17202

Affected Products

Ar120-S

Ar1200

Ar1200-S

Ar150

Ar150-S

Ar160

Ar200

Ar200-S

Ar2200

Ar2200-S

Ar3200

Ar3600

Ar510

Huawei Vrp

Netengine16Ex

Srg1300

Srg2300

Srg3300

References · 3

• https://osv.dev/vulnerability/CVE-2017-17202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17202 · Security Note
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20180131-01-sip-en · Vendor Advisory