Security Advisory - DoS Vulnerability in Huawei U2990 and U2980
- SA No: Huawei-SA-20151111-01-eSpace
- Initial Release Date: Nov 11, 2015
- Last Release Date: Nov 19, 2015
Huawei U2990 and U2980 have a DoS vulnerability caused by no error correction mechanism when handling specific signaling packets. An attacker can send malformed packets to cause a denial of service condition in some services of the U2990 and U2980. (Vulnerability ID: HWPSIRT-2015-09025)
This vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2015-8229.
Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-461219.htm
|
Product Name |
Affected Version |
Resolved Product and Version |
|
eSpace U2980 |
V100R001C02 |
Upgrade to V100R001C10 |
|
eSpace U2990 |
V200R001C02 |
Upgrade to V200R001C10 |
An attacker can exploit this vulnerability to cause the U2990 and U2980 to deny some services.
The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).
Base Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
Temporal Score: 3.3 (E:F/RL:O/RC:C)
1. Prerequisite:
The attacker can access to the device and login.
2. Attacking procedure:
The U2990 and U2980 do not correct errors in specific signaling packets. A malicious device may register with the U2990 and U2980 and send malformed packets to cause the U2990 and U2980 to deny some services.
For security problems about Huawei products and solutions, please contactPSIRT@huawei.com.
For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.
2015-11-19 V1.1 UPDATED add CVE ID
2015-11-11 V1.0 INITIAL
None
