CVE-2017-15356

Huawei DP300, V500R002C00, RP200, V600R006C00, TE30, V100R001C10, V500R002C00,V600R006C00, TE40, V500R002C00, V600R006C00, TE50, V500R002C00,V600R006C00, TE60, V100R001C10, V500R002C00, V600R006C00, TX50,V500R002C00, V600R006C00 have a buffer overflow vulnerability. An attacker may send specially crafted HTTP messages to the affected products. Due insufficient input validation of three different parameters in the messages, successful exploit may cause some service abnormal.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171108-02-http-en	Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171108-02-http-en	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:huawei:dp300_firmware:v500r002c00:*:*:*:*:*:*:*

cpe:2.3:h:huawei:dp300:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:huawei:rp200_firmware:v600r006c00:*:*:*:*:*:*:*

cpe:2.3:h:huawei:rp200:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

OR	cpe:2.3:o:huawei:te30_firmware:v100r001c10:::::::*
	cpe:2.3:o:huawei:te30_firmware:v500r002c00:::::::*
	cpe:2.3:o:huawei:te30_firmware:v600r006c00:::::::*

cpe:2.3:h:huawei:te30:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

OR	cpe:2.3:o:huawei:te40_firmware:v500r002c00:::::::*
	cpe:2.3:o:huawei:te40_firmware:v600r006c00:::::::*

cpe:2.3:h:huawei:te40:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

OR	cpe:2.3:o:huawei:te50_firmware:v500r002c00:::::::*
	cpe:2.3:o:huawei:te50_firmware:v600r006c00:::::::*

cpe:2.3:h:huawei:te50:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

OR	cpe:2.3:o:huawei:te60_firmware:v100r001c10:::::::*
	cpe:2.3:o:huawei:te60_firmware:v500r002c00:::::::*
	cpe:2.3:o:huawei:te60_firmware:v600r006c00:::::::*

cpe:2.3:h:huawei:te60:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND

OR	cpe:2.3:o:huawei:tx50_firmware:v500r002c00:::::::*
	cpe:2.3:o:huawei:tx50_firmware:v600r006c00:::::::*

cpe:2.3:h:huawei:tx50:-:*:*:*:*:*:*:*

History

21 Nov 2024, 03:14

Type	Values Removed	Values Added
References	~~() http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171108-02-http-en - Vendor Advisory~~	() http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171108-02-http-en - Vendor Advisory

Information

Published : 2018-02-15 16:29

Updated : 2024-11-21 03:14

NVD link : CVE-2017-15356

Mitre link : CVE-2017-15356

CVE.ORG link : CVE-2017-15356

JSON object : View

Products Affected

huawei

rp200
te30
te60_firmware
dp300
te40_firmware
te60
tx50_firmware
rp200_firmware
te50_firmware
tx50
te30_firmware
dp300_firmware
te40
te50

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

{"id": "CVE-2017-15356", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2018-02-15T16:29:01.547", "references": [{"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171108-02-http-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}, {"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171108-02-http-en", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "Huawei DP300, V500R002C00, RP200, V600R006C00, TE30, V100R001C10, V500R002C00,V600R006C00, TE40, V500R002C00, V600R006C00, TE50, V500R002C00,V600R006C00, TE60, V100R001C10, V500R002C00, V600R006C00, TX50,V500R002C00, V600R006C00 have a buffer overflow vulnerability. An attacker may send specially crafted HTTP messages to the affected products. Due insufficient input validation of three different parameters in the messages, successful exploit may cause some service abnormal."}, {"lang": "es", "value": "Huawei DP300, V500R002C00, RP200, V600R006C00, TE30, V100R001C10, V500R002C00,V600R006C00, TE40, V500R002C00, V600R006C00, TE50, V500R002C00,V600R006C00, TE60, V100R001C10, V500R002C00, V600R006C00, TX50,V500R002C00 y V600R006C00 tienen una vulnerabilidad de desbordamiento de b\u00fafer. Un atacante podr\u00eda enviar mensajes HTTP especialmente manipulados a los productos afectados. Dada la validaci\u00f3n de entradas insuficiente de los diferentes par\u00e1metros en los mensajes, la explotaci\u00f3n con \u00e9xito podr\u00eda provocar que algunos servicios funcionen err\u00f3neamente."}], "lastModified": "2024-11-21T03:14:32.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:dp300_firmware:v500r002c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8871106B-D3AF-4CFB-A544-1FA411642428"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:dp300:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7F3483B2-9EB6-4E34-900A-945C04A3160D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:rp200_firmware:v600r006c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "67731A77-1DD4-49B2-B437-2850C9583750"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:rp200:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "98275088-2FBE-42F4-AAEC-DF02950B803D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:te30_firmware:v100r001c10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA3EF476-42D7-4758-8DCB-373F46BF1CF5"}, {"criteria": "cpe:2.3:o:huawei:te30_firmware:v500r002c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9DEA387B-4F45-438F-8086-6E80B553163C"}, {"criteria": "cpe:2.3:o:huawei:te30_firmware:v600r006c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "018039EB-7265-4B71-B462-4734FD1D0503"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:te30:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1146F99B-5344-4CD3-AF3F-CD3FE6F6DD91"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:te40_firmware:v500r002c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DDD87254-ABAD-4DFF-BC0D-2CF030063D6F"}, {"criteria": "cpe:2.3:o:huawei:te40_firmware:v600r006c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "931FD3B3-A333-4277-AE55-494F5DB9F09F"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:te40:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "45C3AF58-E030-4E12-A2FD-A4337A5021ED"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:te50_firmware:v500r002c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF7A4D51-314B-4A77-86A7-9C5237BC4275"}, {"criteria": "cpe:2.3:o:huawei:te50_firmware:v600r006c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A70F8924-DC80-4D6F-BA3E-DBFE32FED788"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:te50:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A4F188B3-0A63-4704-9B0D-F8DF5D973FA5"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:te60_firmware:v100r001c10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "092C9FAF-8892-4E16-9C0E-BB1E3488C6C4"}, {"criteria": "cpe:2.3:o:huawei:te60_firmware:v500r002c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "01BC9042-0485-437F-811F-F8898B3B7EA7"}, {"criteria": "cpe:2.3:o:huawei:te60_firmware:v600r006c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A29049D-F472-4772-8750-20730DA624E9"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:te60:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "999117E9-90C8-4E76-90B5-7D364C0B84BF"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:tx50_firmware:v500r002c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ABD47BE6-70B0-49FE-91D1-D5EE4BD9C750"}, {"criteria": "cpe:2.3:o:huawei:tx50_firmware:v600r006c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD35F8E5-9819-4E59-8A42-01990DE8D5CB"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:tx50:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "16DA9D0A-C4E0-48A8-8863-5D54228A405A"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}

5.3 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

5.0 /10

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

JSON object

Attach tags to CVE-2017-15356

5.3^/10

5.0^/10

Attach tags to `CVE-2017-15356`