Security Advisory-Resource Management Vulnerability in the AR1220
- SA No:Huawei-SA-20150318-01-AR1220
- Initial Release Date: Mar 18, 2015
- Last Release Date: Mar 18, 2015
Under Specifically configurations in the AR1220, An attacker sends massive traffic to the FE port from the GE port on the main board. As a result, the interface board resets unexpectedly. (Vulnerability ID: HWPSIRT-2014-1298).
This Vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2015-2255.
|
Product name |
Affected Version |
Resolved Product and Version |
|
AR1220 |
V200R005C00SPC200 |
V200R005SPH006 |
|
V200R005C10SPC500 |
||
|
V200R005C20SPC100 |
||
|
V200R005C20SPC200 |
The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).
Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Temporal Score: 4.1 (E:F/RL:O/RC:C)
1. Prerequisite:
The attacker gains access to the network.
2. Attacking procedure:
Under Specifically configurations, An attacker sends massive traffic to the FE port from the GE port on the main board.
This vulnerability was found by Huawei internal tester. Huawei PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
For security problems about Huawei products and solutions, please contactPSIRT@huawei.com.
For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.
2015-03-18 V1.0 INITIAL
None
