Security Advisory-Improper Input Validation Vulnerability on Multiple Quidway Switch Products
- SA No:Huawei-SA-20140423-01-Quidway
- Initial Release Date: Apr 23, 2014
- Last Release Date: May 13, 2014
Reported by the internal R&D engineers, several switch products does not validate the input properly. This vulnerability enables attacker to launch DoS attack by crafting and sending malformed packet to these vulnerable products (Vulnerability ID: HWPSIRT-2014-0301).
This Vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2014-3224.
|
Product Name |
Vulnerable Versions |
|
Quidway S9700 |
V200R003C00SPC500 |
|
Quidway S9300 |
V200R003C00SPC500 |
|
Quidway S7700 |
V200R003C00SPC500 |
|
Quidway S6700 |
V200R003C00SPC300 |
|
Quidway S6300 |
V200R003C00SPC300 |
|
Quidway S5700 |
V200R003C00SPC300 |
|
Quidway S5300 |
V200R003C00SPC300 |
Once exploited, the vulnerability might cause a excessive resource (e.g. memory) consumption of the vulnerable system and even cause the system to restart in serious cases.
The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).
Base Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
Temporal Score: 6.1 (E:P/RL:O/RC:C)
1. Prerequisite:
a)IP connection is established
b)The equipment is functioned as a client
2. Attacking procedure:
Craft and send malformed packets.
|
Product name |
Fixed version |
Version Status |
|
Quidway S9700 |
V200R003SPH005 |
Released |
|
Quidway S9300 |
V200R003SPH005 |
Released |
|
Quidway S7700 |
V200R003SPH005 |
Released |
|
Quidway S6700 |
V200R003SPH005 |
Released |
|
Quidway S6300 |
V200R003SPH005 |
Released |
|
Quidway S5700 |
V200R003SPH005 |
Released |
|
Quidway S5300 |
V200R003SPH005 |
Released |
This vulnerability is found by Huawei R&D engineers. The Huawei PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
For security problems about Huawei products and solutions, please contactPSIRT@huawei.com.
For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.
2014-05-13 V1.1 FINAL
2014-04-23 V1.0 INITIAL
None
