PT-2018-6491 · Huawei · Te50+5

Published 2018-07-02 · Updated 2018-09-11 · CVE-2017-17316

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: Huawei DP300 versions V500R002C00 through V600R006C00 Huawei RP200 version V500R002C00 Huawei RP200 version V600R006C00 Huawei TE30 versions V100R001C10 through V600R006C00 Huawei TE40 versions V500R002C00 through V600R006C00 Huawei TE50 versions V500R002C00 through V600R006C00 Huawei TE60 versions V100R001C10 through V600R006C00

Description: The issue is related to an out-of-bounds read. An unauthenticated, remote attacker must control the peer device and craft the Signalling Connection Control Part (SCCP) messages to the target devices. Due to insufficient input validation of some values in the messages, a successful exploit will cause an out-of-bounds read and some services to become abnormal.

Recommendations: For Huawei DP300 version V500R002C00, update to a version later than V500R002C00. For Huawei DP300 version V600R006C00, apply configuration changes to restrict the SCCP messages. For Huawei RP200 version V500R002C00, update to a version later than V500R002C00. For Huawei RP200 version V600R006C00, restrict access to the SCCP module. For Huawei TE30 version V100R001C10, update to a version later than V100R001C10. For Huawei TE30 version V600R006C00, apply configuration changes to restrict the SCCP messages. For Huawei TE40 version V500R002C00, update to a version later than V500R002C00. For Huawei TE40 version V600R006C00, restrict access to the SCCP module. For Huawei TE50 version V500R002C00, update to a version later than V500R002C00. For Huawei TE50 version V600R006C00, apply configuration changes to restrict the SCCP messages. For Huawei TE60 version V100R001C10, update to a version later than V100R001C10. For Huawei TE60 version V600R006C00, restrict access to the SCCP module.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2017-17316

Affected Products

Dp300

Rp200

Te30

Te40

Te50

Te60

References · 3

• https://huawei.com/en/psirt/security-advisories/huawei-sa-20180630-01-sccp-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17316 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17316 · Vendor Advisory