Security Advisory-Overflow Vulnerabilities in SNMPv3
- SA No:Huawei-SA-20130425-02
- Initial Release Date: Apr 25, 2013
- Last Release Date: Nov 23, 2015
Simple Network Management Protocol version 3(SNMPv3) is provided by Huawei for network and device management. While the SNMPv3 is enable on some Huawei products, attackers can crash the vulnerable equipment by sending malformed SNMPv3 messages, and make a denial of service (DoS) attack to vulnerable equipment remotely. (Vulnerability ID: HWNSIRT-2013-0427)
These vulnerabilities were first reported by Roberto Paleari of Emaze Networks S.p.A. Huawei would like to thank Roberto Paleari and Emaze Networks S.p.A for reporting these issues and for working with us to help protect the security of our customers.
Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:
http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-260601.htm
|
Product Name |
Affected Version |
Resolved Product and Version |
|
AR 150/ 200/ 1200/ 2200/ 3200 |
V200R001 |
Upgrade to V200R003C01SPC300 |
|
V200R002 |
||
|
V200R003 |
V200R003C01SPC300 |
|
|
CE12800/ CE6850/ CE5850/ CE5810 |
V100R002C00SPC200 |
Upgrade to V100R003C00SPC600B223 |
Attackers can make a DoS attack to vulnerable equipment by exploiting the vulnerability.
The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).
Base Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
Temporal Score: 6.1 (E:P/RL:O/RC:C)
1. Prerequisite:
SNMPv3 is enable;
The IP address of the vulnerable equipment is reachable.
2. Attacking procedure:
When parsing and process SNMPv3 messages, The checking of information copy is not enough and the stack shortage maybe occur, resulting in attacking remotely.
This vulnerability is reported by Roberto Paleari of Emaze Networks S.p.A. Huawei PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
For security problems about Huawei products and solutions, please contact:PSIRT@huawei.com.
For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.
2015-11-23 V1.3 UPDATED update the affected version
2015-02-04 V1.2 UPDATED update content of “Impact”
2013-05-02 V1.1 UPDATED update the affected version
2013-04-25 V1.0 INITIAL
None
