ID

VAR-201802-0560


CVE

CVE-2017-17154


TITLE

plural Huawei Input validation vulnerabilities in products

Trust: 0.8

sources: JVNDB: JVNDB-2017-012417

DESCRIPTION

IKEv2 in Huawei IPS Module V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, V500R001C20SPC300PWE, NGFW Module V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPC500PWE, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, V500R001C20SPC300PWE, NIP6300 V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, V500R001C20SPC300PWE, NIP6600 V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, Secospace USG6300 V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPC500PWE, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC101, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, V500R001C20SPC300PWE, Secospace USG6500 V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPC500PWE, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC101, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, V500R001C20SPC300PWE, Secospace USG6600 V500R001C00, V500R001C00SPC100, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC301, V500R001C00SPC500, V500R001C00SPC500PWE, V500R001C00SPH303, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC101, V500R001C20SPC200, V500R001C20SPC200PWE, V500R001C20SPC300, V500R001C20SPC300B078, V500R001C20SPC300PWE, USG9500 V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC303, V500R001C00SPC500, V500R001C00SPC500PWE, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20SPC100, V500R001C20SPC100PWE, V500R001C20SPC101, V500R001C20SPC200, V500R001C20SPC200B062, V500R001C20SPC200PWE, V500R001C20SPC300B078, V500R001C20SPC300PWE has a DoS vulnerability due to insufficient input validation. An attacker could exploit it to cause unauthorized memory access, which may further lead to system exceptions. Huawei IPS Module is an IPS security device. The NGFW Module is a firewall device. IKEv2 is one of the VPN protocols. IKEv2 in many Huawei products has a denial of service vulnerability. The following products and versions are affected: Huawei IPS Module V500R001C00 Version, V500R001C00SPC200 Version, V500R001C00SPC300 Version, V500R001C00SPC500 Version, V500R001C00SPH303 Version, V500R001C00SPH508 Version, V500R001C20 Version, V500R001C20SPC100 Version, V500R001C20SPC100PWE Version, V500R001C20SPC200 Version, V500R001C20SPC200B062 Version, V500R001C20SPC200PWE Version, V500R001C20SPC300B078 Version, V500R001C20SPC300PWE Version; NGFW Module V500R001C00 Version, V500R001C00SPC200 Version, V500R001C00SPC300 Version, V500R001C00SPC500 Version, V500R001C00SPC500PWE Version, V500R001C00SPH303 Version, V500R001C00SPH508 Version, V500R001C20 Version, V500R001C20SPC100 Version, V500R001C20SPC100PWE Version, V500R001C20SPC200 Version, V500R001C20SPC200B062 Version, V500R001C20SPC200PWE Version, V500R001C20SPC300B078 Version, V500R001C20SPC300PWE Version; NIP6300 ..

Trust: 1.71

sources: NVD: CVE-2017-17154 // JVNDB: JVNDB-2017-012417 // VULHUB: VHN-108148

AFFECTED PRODUCTS

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc100

Trust: 1.6

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc300b078

Trust: 1.6

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc200b062

Trust: 1.6

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc300pwe

Trust: 1.6

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00spc100

Trust: 1.6

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc200

Trust: 1.6

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00sph303

Trust: 1.6

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00spc500

Trust: 1.6

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc101

Trust: 1.6

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc200pwe

Trust: 1.6

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00spc500pwe

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc200b062

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc101

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20spc200b062

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00spc500pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc101

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc200b062

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc300pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00spc500pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc300pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc200b062

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00spc301

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc300pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc300pwe

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc300pwe

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00spc500pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc200b062

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00spc303

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc200pwe

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00spc500

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c20spc101

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc300b078

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:ngfw modulescope:eqversion:v500r001c20

Trust: 1.0

vendor:huaweimodel:secospace usg6500scope:eqversion:v500r001c00

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc300

Trust: 1.0

vendor:huaweimodel:secospace usg6600scope:eqversion:v500r001c20spc300pwe

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c20spc100

Trust: 1.0

vendor:huaweimodel:secospace usg6300scope:eqversion:v500r001c20spc200

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00spc500pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c20spc100pwe

Trust: 1.0

vendor:huaweimodel:ips modulescope:eqversion:v500r001c00spc200

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c00spc300

Trust: 1.0

vendor:huaweimodel:usg9500scope:eqversion:v500r001c00sph303

Trust: 1.0

vendor:huaweimodel:nip6300scope:eqversion:v500r001c20spc200b062

Trust: 1.0

vendor:huaweimodel:nip6600scope:eqversion:v500r001c00sph508

Trust: 1.0

vendor:huaweimodel:ips modulescope: - version: -

Trust: 0.8

vendor:huaweimodel:ngfw modulescope: - version: -

Trust: 0.8

vendor:huaweimodel:nip6300scope: - version: -

Trust: 0.8

vendor:huaweimodel:nip6600scope: - version: -

Trust: 0.8

vendor:huaweimodel:secospace usg6300scope: - version: -

Trust: 0.8

vendor:huaweimodel:secospace usg6500scope: - version: -

Trust: 0.8

vendor:huaweimodel:secospace usg6600scope: - version: -

Trust: 0.8

vendor:huaweimodel:usg9500scope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2017-012417 // CNNVD: CNNVD-201712-319 // NVD: CVE-2017-17154

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-17154
value: HIGH

Trust: 1.0

NVD: CVE-2017-17154
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201712-319
value: MEDIUM

Trust: 0.6

VULHUB: VHN-108148
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-17154
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-108148
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-17154
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-108148 // JVNDB: JVNDB-2017-012417 // CNNVD: CNNVD-201712-319 // NVD: CVE-2017-17154

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-108148 // JVNDB: JVNDB-2017-012417 // NVD: CVE-2017-17154

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201712-319

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201712-319

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-012417

PATCH

title:huawei-sa-20171206-01-ikev2url:http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-01-ikev2-en

Trust: 0.8

sources: JVNDB: JVNDB-2017-012417

EXTERNAL IDS

db:NVDid:CVE-2017-17154

Trust: 2.5

db:JVNDBid:JVNDB-2017-012417

Trust: 0.8

db:CNNVDid:CNNVD-201712-319

Trust: 0.7

db:VULHUBid:VHN-108148

Trust: 0.1

sources: VULHUB: VHN-108148 // JVNDB: JVNDB-2017-012417 // CNNVD: CNNVD-201712-319 // NVD: CVE-2017-17154

REFERENCES

url:http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-01-ikev2-en

Trust: 1.7

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-17154

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2017-17154

Trust: 0.8

sources: VULHUB: VHN-108148 // JVNDB: JVNDB-2017-012417 // CNNVD: CNNVD-201712-319 // NVD: CVE-2017-17154

SOURCES

db:VULHUBid:VHN-108148
db:JVNDBid:JVNDB-2017-012417
db:CNNVDid:CNNVD-201712-319
db:NVDid:CVE-2017-17154

LAST UPDATE DATE

2024-11-23T22:00:41.375000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-108148date:2018-02-24T00:00:00
db:JVNDBid:JVNDB-2017-012417date:2018-03-09T00:00:00
db:CNNVDid:CNNVD-201712-319date:2018-02-22T00:00:00
db:NVDid:CVE-2017-17154date:2024-11-21T03:17:35.817

SOURCES RELEASE DATE

db:VULHUBid:VHN-108148date:2018-02-15T00:00:00
db:JVNDBid:JVNDB-2017-012417date:2018-03-09T00:00:00
db:CNNVDid:CNNVD-201712-319date:2017-12-08T00:00:00
db:NVDid:CVE-2017-17154date:2018-02-15T16:29:01.767