CVE-2019-5275

USG9500 with versions of V500R001C30;V500R001C60 have a denial of service vulnerability. Due to a flaw in the X.509 implementation in the affected products which can result in a heap buffer overflow when decoding a certificate, an attacker may exploit the vulnerability by a malicious certificate to perform a denial of service attack on the affected products.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191225-01-eudemon-en	Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191225-01-eudemon-en	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:huawei:usg9500_firmware:v500r001c30:::::::*
	cpe:2.3:o:huawei:usg9500_firmware:v500r001c60:::::::*

cpe:2.3:h:huawei:usg9500:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:44

Type	Values Removed	Values Added
References	~~() https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191225-01-eudemon-en - Vendor Advisory~~	() https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191225-01-eudemon-en - Vendor Advisory

Information

Published : 2019-12-26 19:15

Updated : 2024-11-21 04:44

NVD link : CVE-2019-5275

Mitre link : CVE-2019-5275

CVE.ORG link : CVE-2019-5275

JSON object : View

Products Affected

huawei

usg9500
usg9500_firmware

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2019-5275", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-12-26T19:15:11.127", "references": [{"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191225-01-eudemon-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}, {"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191225-01-eudemon-en", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "USG9500 with versions of V500R001C30;V500R001C60 have a denial of service vulnerability. Due to a flaw in the X.509 implementation in the affected products which can result in a heap buffer overflow when decoding a certificate, an attacker may exploit the vulnerability by a malicious certificate to perform a denial of service attack on the affected products."}, {"lang": "es", "value": "USG9500 con versiones desde V500R001C30;V500R001C60 presentan una vulnerabilidad de denegaci\u00f3n de servicio. Debido a un fallo en la implementaci\u00f3n de X.509 en los productos afectados lo que puede resultar en un desbordamiento de b\u00fafer de la pila cuando se decodifica un certificado, un atacante puede explotar la vulnerabilidad mediante un certificado malicioso para llevar a cabo un ataque de denegaci\u00f3n de servicio en los productos afectados."}], "lastModified": "2024-11-21T04:44:39.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:usg9500_firmware:v500r001c30:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80F14B3F-EA8C-4A01-9968-08ECACDA6CBD"}, {"criteria": "cpe:2.3:o:huawei:usg9500_firmware:v500r001c60:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74B7C57C-7CD4-4FF0-BE51-2F4794FED7AE"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:usg9500:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4B6064BB-5E62-4D70-B933-05B5426EEE9C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}