ID

VAR-201802-0559


CVE

CVE-2017-17153


TITLE

plural Huawei Vulnerability related to input validation in products

Trust: 0.8

sources: JVNDB: JVNDB-2017-012416

DESCRIPTION

IKEv2 in Huawei IPS Module V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, V500R001C20SPC300PWE, NGFW Module V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPC500PWE, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, V500R001C20SPC300PWE, NIP6300 V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, V500R001C20SPC300PWE, NIP6600 V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, Secospace USG6300 V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPC500PWE, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC101, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, V500R001C20SPC300PWE, Secospace USG6500 V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPC500PWE, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC101, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, V500R001C20SPC300PWE, Secospace USG6600 V500R001C00, V500R001C00SPC100, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC301, V500R001C00SPC500, V500R001C00SPC500PWE, V500R001C00SPH303, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC101, V500R001C20SPC200, V500R001C20SPC200PWE, V500R001C20SPC300, V500R001C20SPC300B078, V500R001C20SPC300PWE, USG9500 V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC303, V500R001C00SPC500, V500R001C00SPC500PWE, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC101, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, V500R001C20SPC300PWE has a memory leak vulnerability due to memory release failure resulted from insufficient input validation. An attacker could exploit it to cause memory leak, which may further lead to system exceptions. plural Huawei The product contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. The Huawei IPS Module and others are all products of China's Huawei (Huawei). Huawei IPS Module is an IPS security device. The NGFW Module is a firewall device. IKEv2 is one of the VPN protocols. IKEv2 in many Huawei products has a memory leak vulnerability, which is caused by the program not fully verifying the received packets. The following products and versions are affected: Huawei IPS Module V500R001C00 Version, V500R001C00SPC200 Version, V500R001C00SPC300 Version, V500R001C00SPC500 Version, V500R001C00SPH303 Version, V500R001C00SPH508 Version, V500R001C20 Version, V500R001C20SPC100 Version, V500R001C20SPC100PWE Version, V500R001C20SPC200 Version, V500R001C20SPC200B062 Version, V500R001C20SPC200PWE Version, V500R001C20SPC300B078 Version, V500R001C20SPC300PWE Version; NGFW Module V500R001C00 Version, V500R001C00SPC200 Version, V500R001C00SPC300 Version, V500R001C00SPC500 Version, V500R001C00SPC500PWE Version, V500R001C00SPH303 Version, V500R001C00SPH508 Version, V500R001C20 Version, V500R001C20SPC100 Version, V500R001C20SPC100PWE Version, V500R001C20SPC200 Version, V500R001C20SPC200B062 Version, V500R001C20SPC200PWE Version, V500R001C20SPC300B078 Version, V500R001C20SPC300PWE Version; NIP6300 ..

Trust: 1.71

sources: NVD: CVE-2017-17153 // JVNDB: JVNDB-2017-012416 // VULHUB: VHN-108147

AFFECTED PRODUCTS

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc101

Trust: 1.6

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc200pwe

Trust: 1.6

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc100

Trust: 1.6

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc300b078

Trust: 1.6

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc200b062

Trust: 1.6

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc300pwe

Trust: 1.6

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc100pwe

Trust: 1.6

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20

Trust: 1.6

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00sph508

Trust: 1.6

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc200

Trust: 1.6

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00spc500pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc101

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc200b062

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20spc200b062

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00spc500pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc101

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc200b062

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc300pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc101

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00spc500pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc300pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc200b062

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00spc301

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc300pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc300pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00spc500pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc300pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00spc100

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc200b062

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00spc303

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc300

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc300pwe

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00spc500pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc200b062

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:ips modulescope: - version: -

Trust: 0.8

vendor:huaweimodel:ngfw modulescope: - version: -

Trust: 0.8

vendor:huaweimodel:nip6300scope: - version: -

Trust: 0.8

vendor:huaweimodel:nip6600scope: - version: -

Trust: 0.8

vendor:huaweimodel:secospace usg6300scope: - version: -

Trust: 0.8

vendor:huaweimodel:secospace usg6500scope: - version: -

Trust: 0.8

vendor:huaweimodel:secospace usg6600scope: - version: -

Trust: 0.8

vendor:huaweimodel:usg9500scope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2017-012416 // CNNVD: CNNVD-201712-320 // NVD: CVE-2017-17153

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-17153
value: HIGH

Trust: 1.0

NVD: CVE-2017-17153
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201712-320
value: HIGH

Trust: 0.6

VULHUB: VHN-108147
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-17153
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-108147
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-17153
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-108147 // JVNDB: JVNDB-2017-012416 // CNNVD: CNNVD-201712-320 // NVD: CVE-2017-17153

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

problemtype:CWE-772

Trust: 1.1

sources: VULHUB: VHN-108147 // JVNDB: JVNDB-2017-012416 // NVD: CVE-2017-17153

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201712-320

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201712-320

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-012416

PATCH

title:huawei-sa-20171206-01-ikev2url:http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-01-ikev2-en

Trust: 0.8

title:Multiple Huawei product IKEv2 Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=100241

Trust: 0.6

sources: JVNDB: JVNDB-2017-012416 // CNNVD: CNNVD-201712-320

EXTERNAL IDS

db:NVDid:CVE-2017-17153

Trust: 2.5

db:JVNDBid:JVNDB-2017-012416

Trust: 0.8

db:CNNVDid:CNNVD-201712-320

Trust: 0.7

db:VULHUBid:VHN-108147

Trust: 0.1

sources: VULHUB: VHN-108147 // JVNDB: JVNDB-2017-012416 // CNNVD: CNNVD-201712-320 // NVD: CVE-2017-17153

REFERENCES

url:http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-01-ikev2-en

Trust: 1.7

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-17153

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2017-17153

Trust: 0.8

sources: VULHUB: VHN-108147 // JVNDB: JVNDB-2017-012416 // CNNVD: CNNVD-201712-320 // NVD: CVE-2017-17153

SOURCES

db:VULHUBid:VHN-108147
db:JVNDBid:JVNDB-2017-012416
db:CNNVDid:CNNVD-201712-320
db:NVDid:CVE-2017-17153

LAST UPDATE DATE

2024-11-23T21:39:41.848000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-108147date:2019-10-03T00:00:00
db:JVNDBid:JVNDB-2017-012416date:2018-03-09T00:00:00
db:CNNVDid:CNNVD-201712-320date:2019-10-23T00:00:00
db:NVDid:CVE-2017-17153date:2024-11-21T03:17:35.667

SOURCES RELEASE DATE

db:VULHUBid:VHN-108147date:2018-02-15T00:00:00
db:JVNDBid:JVNDB-2017-012416date:2018-03-09T00:00:00
db:CNNVDid:CNNVD-201712-320date:2017-12-08T00:00:00
db:NVDid:CVE-2017-17153date:2018-02-15T16:29:01.720