Lucene search

[email protected]CVE-2017-17330

HistoryMar 09, 2018 - 5:29 p.m.

CVE-2017-17330

2018-03-0917:29:02

CWE-772

[email protected]

web.nvd.nist.gov

huawei

ar3200

v200r005c32

v200r006c10

v200r006c11

v200r007c00

v200r007c01

v200r007c02

v200r008c00

v200r008c10

v200r008c20

v200r008c30

ngfw

module

v500r001c00

v500r001c20

v500r002c00

memory leak

vulnerability

xml

nvd

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.8%

JSON

Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20; V500R002C00 have a memory leak vulnerability. The software does not release allocated memory properly when parse XML element data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory.

Affected configurations

NVD

Node

huaweiar3200_firmwareMatchv200r005c32

huaweiar3200_firmwareMatchv200r006c10

huaweiar3200_firmwareMatchv200r006c11

huaweiar3200_firmwareMatchv200r007c00

huaweiar3200_firmwareMatchv200r007c01

huaweiar3200_firmwareMatchv200r007c02

huaweiar3200_firmwareMatchv200r008c00

huaweiar3200_firmwareMatchv200r008c10

huaweiar3200_firmwareMatchv200r008c20

huaweiar3200_firmwareMatchv200r008c30

AND

huaweiar3200Match-

Node

huaweingfw_module_firmwareMatchv500r001c00

huaweingfw_module_firmwareMatchv500r001c20

huaweingfw_module_firmwareMatchv500r002c00

AND

huaweingfw_moduleMatch-

CPENameOperatorVersion
huawei:ar3200_firmwarehuawei ar3200 firmwareeqv200r005c32
huawei:ar3200_firmwarehuawei ar3200 firmwareeqv200r006c10
huawei:ar3200_firmwarehuawei ar3200 firmwareeqv200r006c11
huawei:ar3200_firmwarehuawei ar3200 firmwareeqv200r007c00
huawei:ar3200_firmwarehuawei ar3200 firmwareeqv200r007c01
huawei:ar3200_firmwarehuawei ar3200 firmwareeqv200r007c02
huawei:ar3200_firmwarehuawei ar3200 firmwareeqv200r008c00
huawei:ar3200_firmwarehuawei ar3200 firmwareeqv200r008c10
huawei:ar3200_firmwarehuawei ar3200 firmwareeqv200r008c20
huawei:ar3200_firmwarehuawei ar3200 firmwareeqv200r008c30

CPE	Name	Operator	Version
huawei:ar3200_firmware	huawei ar3200 firmware	eq	v200r005c32
huawei:ar3200_firmware	huawei ar3200 firmware	eq	v200r006c10
huawei:ar3200_firmware	huawei ar3200 firmware	eq	v200r006c11
huawei:ar3200_firmware	huawei ar3200 firmware	eq	v200r007c00
huawei:ar3200_firmware	huawei ar3200 firmware	eq	v200r007c01
huawei:ar3200_firmware	huawei ar3200 firmware	eq	v200r007c02
huawei:ar3200_firmware	huawei ar3200 firmware	eq	v200r008c00
huawei:ar3200_firmware	huawei ar3200 firmware	eq	v200r008c10
huawei:ar3200_firmware	huawei ar3200 firmware	eq	v200r008c20
huawei:ar3200_firmware	huawei ar3200 firmware	eq	v200r008c30

CNA Affected

[
  {
    "product": "AR3200; NGFW Module",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "AR3200 V200R005C32"
      },
      {
        "status": "affected",
        "version": "V200R006C10"
      },
      {
        "status": "affected",
        "version": "V200R006C11"
      },
      {
        "status": "affected",
        "version": "V200R007C00"
      },
      {
        "status": "affected",
        "version": "V200R007C01"
      },
      {
        "status": "affected",
        "version": "V200R007C02"
      },
      {
        "status": "affected",
        "version": "V200R008C00"
      },
      {
        "status": "affected",
        "version": "V200R008C10"
      },
      {
        "status": "affected",
        "version": "V200R008C20"
      },
      {
        "status": "affected",
        "version": "V200R008C30"
      },
      {
        "status": "affected",
        "version": "NGFW Module V500R001C00"
      },
      {
        "status": "affected",
        "version": "V500R001C20"
      },
      {
        "status": "affected",
        "version": "V500R002C00"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.8%

JSON

Related for CVE-2017-17330

cvelist1 openvas2 prion1 nvd1 huawei1