PT-2018-6492 · Huawei · Te50+6

Published 2018-07-02 · Updated 2018-08-24 · CVE-2017-17317

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: Huawei USG6300 versions V100R001C10 through V100R001C30 Huawei USG6300 versions V500R001C00 through V500R001C50 Secospace USG6500 versions V100R001C10 through V100R001C30 Secospace USG6500 versions V500R001C00 through V500R001C50 Secospace USG6600 versions V100R001C00 through V100R001C30 Secospace USG6600 versions V500R001C00 through V500R001C50 TE30 versions V100R001C02 through V100R001C10 TE30 versions V500R002C00 through V600R006C00 TE40 versions V500R002C00 through V600R006C00 TE50 versions V500R002C00 through V600R006C00 TE60 versions V100R001C01 through V100R001C10 TE60 versions V500R002C00 through V600R006C00

Description: The issue is related to a buffer overflow vulnerability in the Common Open Policy Service Protocol (COPS) module. This vulnerability can be exploited by an unauthenticated, remote attacker who controls the peer device and sends specially crafted messages to the affected products. The root cause is insufficient input validation, which may lead to abnormal services if the exploit is successful.

Recommendations: For Huawei USG6300 versions V100R001C10 through V100R001C30, update to a version outside of this range to resolve the issue. For Huawei USG6300 versions V500R001C00 through V500R001C50, update to a version outside of this range to resolve the issue. For Secospace USG6500 versions V100R001C10 through V100R001C30, update to a version outside of this range to resolve the issue. For Secospace USG6500 versions V500R001C00 through V500R001C50, update to a version outside of this range to resolve the issue. For Secospace USG6600 versions V100R001C00 through V100R001C30, update to a version outside of this range to resolve the issue. For Secospace USG6600 versions V500R001C00 through V500R001C50, update to a version outside of this range to resolve the issue. For TE30 versions V100R001C02 through V100R001C10, update to a version outside of this range to resolve the issue. For TE30 versions V500R002C00 through V600R006C00, update to a version outside of this range to resolve the issue. For TE40 versions V500R002C00 through V600R006C00, update to a version outside of this range to resolve the issue. For TE50 versions V500R002C00 through V600R006C00, update to a version outside of this range to resolve the issue. For TE60 versions V100R001C01 through V100R001C10, update to a version outside of this range to resolve the issue. For TE60 versions V500R002C00 through V600R006C00, update to a version outside of this range to resolve the issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-17317

Affected Products

Huawei S6300

Secospace Usg6500

Secospace Usg6600

Te30

Te40

Te50

Te60

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-17317 · Security Note
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20180630-01-cops-en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-17317 · Vendor Advisory