fkie_cve-2017-17330
Vulnerability from fkie_nvd
Published
2018-03-09 17:29
Modified
2024-11-21 03:17
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Summary
Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20; V500R002C00 have a memory leak vulnerability. The software does not release allocated memory properly when parse XML element data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory.
References
psirt@huawei.comhttp://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-enVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-enVendor Advisory
Impacted products
Vendor Product Version
huawei ar3200_firmware v200r005c32
huawei ar3200_firmware v200r006c10
huawei ar3200_firmware v200r006c11
huawei ar3200_firmware v200r007c00
huawei ar3200_firmware v200r007c01
huawei ar3200_firmware v200r007c02
huawei ar3200_firmware v200r008c00
huawei ar3200_firmware v200r008c10
huawei ar3200_firmware v200r008c20
huawei ar3200_firmware v200r008c30
huawei ar3200 -
huawei ngfw_module_firmware v500r001c00
huawei ngfw_module_firmware v500r001c20
huawei ngfw_module_firmware v500r002c00
huawei ngfw_module -


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:ar3200_firmware:v200r005c32:*:*:*:*:*:*:*",
              "matchCriteriaId": "7FE26EE9-2331-4D72-96CF-635A0A4EBE3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:huawei:ar3200_firmware:v200r006c10:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB9A3444-A485-4B87-B910-F3DA5C8E5D74",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:huawei:ar3200_firmware:v200r006c11:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8BE6310-A42C-4BB3-BB02-7CE6F4FF340D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:huawei:ar3200_firmware:v200r007c00:*:*:*:*:*:*:*",
              "matchCriteriaId": "9752658E-3CF5-4D9E-98FB-D15FD892479C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:huawei:ar3200_firmware:v200r007c01:*:*:*:*:*:*:*",
              "matchCriteriaId": "0595B3AA-8911-44AF-996B-2F431517FBED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:huawei:ar3200_firmware:v200r007c02:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC727A7A-CF3D-4DC9-9083-A0CE8ED886A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:huawei:ar3200_firmware:v200r008c00:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A842B77-C902-4B20-A171-3F98C75E6160",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:huawei:ar3200_firmware:v200r008c10:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC61DFB2-E24C-4148-892E-A14F1EC3F9CA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:huawei:ar3200_firmware:v200r008c20:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8D0F6C6-5A87-482B-8B2A-693AC7736CB9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:huawei:ar3200_firmware:v200r008c30:*:*:*:*:*:*:*",
              "matchCriteriaId": "B01969DE-DC37-4F2F-BB9B-5242810A8317",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:ar3200:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9309E1AA-0C4E-422C-9307-A8DD0AE5D576",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:ngfw_module_firmware:v500r001c00:*:*:*:*:*:*:*",
              "matchCriteriaId": "80411236-6B22-4937-87F3-E06C991B14D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:huawei:ngfw_module_firmware:v500r001c20:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A8E1096-F070-4CE9-B2B4-6368890706A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:huawei:ngfw_module_firmware:v500r002c00:*:*:*:*:*:*:*",
              "matchCriteriaId": "F46A81BE-C125-4CAE-8EE1-23177FE0C21E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:ngfw_module:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "547D4A9A-6B57-4BBA-9FFE-CF50B9AC5DF4",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20; V500R002C00 have a memory leak vulnerability. The software does not release allocated memory properly when parse XML element data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory."
    },
    {
      "lang": "es",
      "value": "Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20 y V500R002C00 tienen una vulnerabilidad de filtrado de memoria. El software no libera la memoria asignada correctamente al analizar los datos de elementos XML. Un atacante autenticado podr\u00eda subir un archivo XML manipulado, por lo que la explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda provocar que los servicios del sistema funcionen de manera incorrecta, ya que se quedar\u00edan sin memoria."
    }
  ],
  "id": "CVE-2017-17330",
  "lastModified": "2024-11-21T03:17:51.020",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 2.1,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 3.3,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.0"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-03-09T17:29:02.330",
  "references": [
    {
      "source": "psirt@huawei.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en"
    }
  ],
  "sourceIdentifier": "psirt@huawei.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-772"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.