ID

VAR-201802-0558


CVE

CVE-2017-17152


TITLE

plural Huawei Vulnerability related to input validation in products

Trust: 0.8

sources: JVNDB: JVNDB-2017-012459

DESCRIPTION

IKEv2 in Huawei IPS Module V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, V500R001C20SPC300PWE, NGFW Module V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPC500PWE, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, V500R001C20SPC300PWE, NIP6300 V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, V500R001C20SPC300PWE, NIP6600 V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, Secospace USG6300 V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPC500PWE, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC101, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, V500R001C20SPC300PWE, Secospace USG6500 V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPC500PWE, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC101, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, V500R001C20SPC300PWE, Secospace USG6600 V500R001C00, V500R001C00SPC100, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC301, V500R001C00SPC500, V500R001C00SPC500PWE, V500R001C00SPH303, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC101, V500R001C20SPC200, V500R001C20SPC200PWE, V500R001C20SPC300, V500R001C20SPC300B078, V500R001C20SPC300PWE, USG9500 V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC303, V500R001C00SPC500, V500R001C00SPC500PWE, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC101, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, V500R001C20SPC300PWE has an out-of-bounds write vulnerability due to insufficient input validation. An attacker could exploit it to craft special packets to trigger out-of-bounds memory write, which may further lead to system exceptions. plural Huawei There are vulnerabilities related to input validation and out-of-bounds writing in the product.Service operation interruption (DoS) There is a possibility of being put into a state. The Huawei IPS Module and others are all products of China's Huawei (Huawei). Huawei IPS Module is an IPS security device. The NGFW Module is a firewall device. IKEv2 is one of the VPN protocols. There are security vulnerabilities in IKEv2 in many Huawei products. The following products and versions are affected: Huawei IPS Module V500R001C00 Version, V500R001C00SPC200 Version, V500R001C00SPC300 Version, V500R001C00SPC500 Version, V500R001C00SPH303 Version, V500R001C00SPH508 Version, V500R001C20 Version, V500R001C20SPC100 Version, V500R001C20SPC100PWE Version, V500R001C20SPC200 Version, V500R001C20SPC200B062 Version, V500R001C20SPC200PWE Version, V500R001C20SPC300B078 Version, V500R001C20SPC300PWE Version; NGFW Module V500R001C00 Version, V500R001C00SPC200 Version, V500R001C00SPC300 Version, V500R001C00SPC500 Version, V500R001C00SPC500PWE Version, V500R001C00SPH303 Version, V500R001C00SPH508 Version, V500R001C20 Version, V500R001C20SPC100 Version, V500R001C20SPC100PWE Version, V500R001C20SPC200 Version, V500R001C20SPC200B062 Version, V500R001C20SPC200PWE Version, V500R001C20SPC300B078 Version, V500R001C20SPC300PWE Version; NIP6300 ..

Trust: 1.71

sources: NVD: CVE-2017-17152 // JVNDB: JVNDB-2017-012459 // VULHUB: VHN-108146

AFFECTED PRODUCTS

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc101

Trust: 1.6

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc200pwe

Trust: 1.6

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc100

Trust: 1.6

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc300b078

Trust: 1.6

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc200b062

Trust: 1.6

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc300pwe

Trust: 1.6

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc100pwe

Trust: 1.6

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20

Trust: 1.6

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00sph508

Trust: 1.6

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc200

Trust: 1.6

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00spc500pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc101

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc200b062

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20spc200b062

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00spc500pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc101

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc200b062

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc300pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc101

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00spc500pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc300pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc200b062

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00spc301

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc300pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc300pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00spc500pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc300pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00spc100

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc200b062

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00spc303

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc300

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc300pwe

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00spc500pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc200b062

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:ips modulescope: - version: -

Trust: 0.8

vendor:huaweimodel:ngfw modulescope: - version: -

Trust: 0.8

vendor:huaweimodel:nip6300scope: - version: -

Trust: 0.8

vendor:huaweimodel:nip6600scope: - version: -

Trust: 0.8

vendor:huaweimodel:secospace usg6300scope: - version: -

Trust: 0.8

vendor:huaweimodel:secospace usg6500scope: - version: -

Trust: 0.8

vendor:huaweimodel:secospace usg6600scope: - version: -

Trust: 0.8

vendor:huaweimodel:usg9500scope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2017-012459 // CNNVD: CNNVD-201712-321 // NVD: CVE-2017-17152

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-17152
value: MEDIUM

Trust: 1.0

NVD: CVE-2017-17152
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201712-321
value: MEDIUM

Trust: 0.6

VULHUB: VHN-108146
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-17152
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-108146
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-17152
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-108146 // JVNDB: JVNDB-2017-012459 // CNNVD: CNNVD-201712-321 // NVD: CVE-2017-17152

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

problemtype:CWE-787

Trust: 1.9

sources: VULHUB: VHN-108146 // JVNDB: JVNDB-2017-012459 // NVD: CVE-2017-17152

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201712-321

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201712-321

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-012459

PATCH

title:huawei-sa-20171206-01-ikev2url:http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-01-ikev2-en

Trust: 0.8

sources: JVNDB: JVNDB-2017-012459

EXTERNAL IDS

db:NVDid:CVE-2017-17152

Trust: 2.5

db:JVNDBid:JVNDB-2017-012459

Trust: 0.8

db:CNNVDid:CNNVD-201712-321

Trust: 0.7

db:VULHUBid:VHN-108146

Trust: 0.1

sources: VULHUB: VHN-108146 // JVNDB: JVNDB-2017-012459 // CNNVD: CNNVD-201712-321 // NVD: CVE-2017-17152

REFERENCES

url:http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-01-ikev2-en

Trust: 1.7

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-17152

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2017-17152

Trust: 0.8

sources: VULHUB: VHN-108146 // JVNDB: JVNDB-2017-012459 // CNNVD: CNNVD-201712-321 // NVD: CVE-2017-17152

SOURCES

db:VULHUBid:VHN-108146
db:JVNDBid:JVNDB-2017-012459
db:CNNVDid:CNNVD-201712-321
db:NVDid:CVE-2017-17152

LAST UPDATE DATE

2024-11-23T23:08:46.980000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-108146date:2018-02-26T00:00:00
db:JVNDBid:JVNDB-2017-012459date:2018-03-09T00:00:00
db:CNNVDid:CNNVD-201712-321date:2018-02-22T00:00:00
db:NVDid:CVE-2017-17152date:2024-11-21T03:17:35.517

SOURCES RELEASE DATE

db:VULHUBid:VHN-108146date:2018-02-15T00:00:00
db:JVNDBid:JVNDB-2017-012459date:2018-03-09T00:00:00
db:CNNVDid:CNNVD-201712-321date:2017-12-08T00:00:00
db:NVDid:CVE-2017-17152date:2018-02-15T16:29:01.657