cnvd - cnvd-2016-03649

cnvd-2016-03649

Vulnerability from cnvd

Title: 多款Huawei产品拒绝服务漏洞（CNVD-2016-03649）

Description:

Huawei AC6605等都是中国华为（Huawei）公司的无线接入控制器产品。

多款Huawei产品的SSH模块中存在安全漏洞，该漏洞源于程序在处理报文时，对报文内容中某个域缺少有效校验。攻击者可利用该漏洞导致使用VRP平台的设备服务中断。

Severity: 高

Patch Name: 多款Huawei产品拒绝服务漏洞（CNVD-2016-03649）的补丁

Patch Description:

Huawei AC6605等都是中国华为（Huawei）公司的无线接入控制器产品。

多款Huawei产品的SSH模块中存在安全漏洞，该漏洞源于程序在处理报文时，对报文内容中某个域缺少有效校验。攻击者可利用该漏洞导致使用VRP平台的设备服务中断。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： http://www.huawei.com/cn/psirt/security-advisories/hw-373183

Reference: http://www.huawei.com/cn/psirt/security-advisories/hw-373183

Impacted products

Name
['Huawei AC6605 V200R001C00', 'Huawei AC6605 V200R002C00', 'Huawei ACU V200R001C00', 'Huawei ACU V200R002C00', 'Huawei S2300 <=V100R006C05', 'Huawei S3300 <=V100R006C05', 'Huawei S2700 <=V100R006C05', 'Huawei S3700 <=V100R006C05', 'Huawei S5300 V100R006', 'Huawei S5300 V200R001', 'Huawei S5300 V200R002', 'Huawei S5300 V200R003', 'Huawei S5300 <=V200R005C00SPC300', 'Huawei S5700 V100R006', 'Huawei S5700 V200R001', 'Huawei S5700 V200R002', 'Huawei S5700 V200R003', 'Huawei S5700 <=V200R005C00SPC300', 'Huawei S6300 V100R006', 'Huawei S6300 V200R001', 'Huawei S6300 V200R002', 'Huawei S6300 V200R003', 'Huawei S6300 <=V200R005C00SPC300', 'Huawei S6700 V100R006', 'Huawei S6700 V200R001', 'Huawei S6700 V200R002', 'Huawei S6700 V200R003', 'Huawei S6700 <=V200R005C00SPC300', 'Huawei S7700 V100R006', 'Huawei S7700 V200R001', 'Huawei S7700 V200R002', 'Huawei S7700 V200R003', 'Huawei S7700 <=V200R005C00SPC300', 'Huawei S9300 V100R006', 'Huawei S9300 V200R001', 'Huawei S9300 V200R002', 'Huawei S9300 V200R003', 'Huawei S9300 <=V200R005C00SPC300', 'Huawei S9300E V100R006', 'Huawei S9300E V200R001', 'Huawei S9300E V200R002', 'Huawei S9300E V200R003', 'Huawei S9300E <=V200R005C00SPC300', 'Huawei S9700 V100R006', 'Huawei S9700 V200R001', 'Huawei S9700 V200R002', 'Huawei S9700 V200R003', 'Huawei S9700 <=V200R005C00SPC300']

Name

['Huawei AC6605 V200R001C00', 'Huawei AC6605 V200R002C00', 'Huawei ACU V200R001C00', 'Huawei ACU V200R002C00', 'Huawei S2300 <=V100R006C05', 'Huawei S3300 <=V100R006C05', 'Huawei S2700 <=V100R006C05', 'Huawei S3700 <=V100R006C05', 'Huawei S5300 V100R006', 'Huawei S5300 V200R001', 'Huawei S5300 V200R002', 'Huawei S5300 V200R003', 'Huawei S5300 <=V200R005C00SPC300', 'Huawei S5700 V100R006', 'Huawei S5700 V200R001', 'Huawei S5700 V200R002', 'Huawei S5700 V200R003', 'Huawei S5700 <=V200R005C00SPC300', 'Huawei S6300 V100R006', 'Huawei S6300 V200R001', 'Huawei S6300 V200R002', 'Huawei S6300 V200R003', 'Huawei S6300 <=V200R005C00SPC300', 'Huawei S6700 V100R006', 'Huawei S6700 V200R001', 'Huawei S6700 V200R002', 'Huawei S6700 V200R003', 'Huawei S6700 <=V200R005C00SPC300', 'Huawei S7700 V100R006', 'Huawei S7700 V200R001', 'Huawei S7700 V200R002', 'Huawei S7700 V200R003', 'Huawei S7700 <=V200R005C00SPC300', 'Huawei S9300 V100R006', 'Huawei S9300 V200R001', 'Huawei S9300 V200R002', 'Huawei S9300 V200R003', 'Huawei S9300 <=V200R005C00SPC300', 'Huawei S9300E V100R006', 'Huawei S9300E V200R001', 'Huawei S9300E V200R002', 'Huawei S9300E V200R003', 'Huawei S9300E <=V200R005C00SPC300', 'Huawei S9700 V100R006', 'Huawei S9700 V200R001', 'Huawei S9700 V200R002', 'Huawei S9700 V200R003', 'Huawei S9700 <=V200R005C00SPC300']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2014-8572"
    }
  },
  "description": "Huawei AC6605\u7b49\u90fd\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u65e0\u7ebf\u63a5\u5165\u63a7\u5236\u5668\u4ea7\u54c1\u3002\r\n\r\n\u591a\u6b3eHuawei\u4ea7\u54c1\u7684SSH\u6a21\u5757\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u5728\u5904\u7406\u62a5\u6587\u65f6\uff0c\u5bf9\u62a5\u6587\u5185\u5bb9\u4e2d\u67d0\u4e2a\u57df\u7f3a\u5c11\u6709\u6548\u6821\u9a8c\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u4f7f\u7528VRP\u5e73\u53f0\u7684\u8bbe\u5907\u670d\u52a1\u4e2d\u65ad\u3002",
  "discovererName": "Huawei",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://www.huawei.com/cn/psirt/security-advisories/hw-373183",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-03649",
  "openTime": "2016-05-27",
  "patchDescription": "Huawei AC6605\u7b49\u90fd\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u65e0\u7ebf\u63a5\u5165\u63a7\u5236\u5668\u4ea7\u54c1\u3002\r\n\r\n\u591a\u6b3eHuawei\u4ea7\u54c1\u7684SSH\u6a21\u5757\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u5728\u5904\u7406\u62a5\u6587\u65f6\uff0c\u5bf9\u62a5\u6587\u5185\u5bb9\u4e2d\u67d0\u4e2a\u57df\u7f3a\u5c11\u6709\u6548\u6821\u9a8c\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u4f7f\u7528VRP\u5e73\u53f0\u7684\u8bbe\u5907\u670d\u52a1\u4e2d\u65ad\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eHuawei\u4ea7\u54c1\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2016-03649\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Huawei AC6605 V200R001C00",
      "Huawei AC6605 V200R002C00",
      "Huawei ACU V200R001C00",
      "Huawei ACU V200R002C00",
      "Huawei S2300 \u003c=V100R006C05",
      "Huawei S3300 \u003c=V100R006C05",
      "Huawei S2700 \u003c=V100R006C05",
      "Huawei S3700 \u003c=V100R006C05",
      "Huawei S5300 V100R006",
      "Huawei S5300 V200R001",
      "Huawei S5300 V200R002",
      "Huawei S5300 V200R003",
      "Huawei S5300 \u003c=V200R005C00SPC300",
      "Huawei S5700 V100R006",
      "Huawei S5700 V200R001",
      "Huawei S5700 V200R002",
      "Huawei S5700 V200R003",
      "Huawei S5700 \u003c=V200R005C00SPC300",
      "Huawei S6300 V100R006",
      "Huawei S6300 V200R001",
      "Huawei S6300 V200R002",
      "Huawei S6300 V200R003",
      "Huawei S6300 \u003c=V200R005C00SPC300",
      "Huawei S6700 V100R006",
      "Huawei S6700 V200R001",
      "Huawei S6700 V200R002",
      "Huawei S6700 V200R003",
      "Huawei S6700 \u003c=V200R005C00SPC300",
      "Huawei S7700 V100R006",
      "Huawei S7700 V200R001",
      "Huawei S7700 V200R002",
      "Huawei S7700 V200R003",
      "Huawei S7700 \u003c=V200R005C00SPC300",
      "Huawei S9300 V100R006",
      "Huawei S9300 V200R001",
      "Huawei S9300 V200R002",
      "Huawei S9300 V200R003",
      "Huawei S9300 \u003c=V200R005C00SPC300",
      "Huawei S9300E V100R006",
      "Huawei S9300E V200R001",
      "Huawei S9300E V200R002",
      "Huawei S9300E V200R003",
      "Huawei S9300E \u003c=V200R005C00SPC300",
      "Huawei S9700 V100R006",
      "Huawei S9700 V200R001",
      "Huawei S9700 V200R002",
      "Huawei S9700 V200R003",
      "Huawei S9700 \u003c=V200R005C00SPC300"
    ]
  },
  "referenceLink": "http://www.huawei.com/cn/psirt/security-advisories/hw-373183",
  "serverity": "\u9ad8",
  "submitTime": "2016-05-26",
  "title": "\u591a\u6b3eHuawei\u4ea7\u54c1\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2016-03649\uff09"
}

CVE-2014-8572 (GCVE-0-2014-8572)

Vulnerability from cvelistv5

Published

2017-04-02 20:00

Modified

2024-08-06 13:18

Severity ?

CWE

SSH Denial of Service

Summary

Huawei AC6605 with software V200R001C00; AC6605 with software V200R002C00; ACU with software V200R001C00; ACU with software V200R002C00; S2300, S3300, S2700, S3700 with software V100R006C05 and earlier versions; S5300, S5700, S6300, S6700 with software V100R006, V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions; S7700, S9300, S9300E, S9700 with software V100R006, V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions could allow remote attackers to send a special SSH packet to the VRP device to cause a denial of service.

References

▼	URL	Tags
	http://www.huawei.com/en/psirt/security-advisories/hw-373182	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	AC6605,AC6605,ACU,S2300, S3300,S2700, S3700,S5300, S5700,S6300, S6700,S7700, S9300,S9300E, S9700, AC6605 AC6605 V200R001C00, AC6605 V200R002C00,ACU ACU V200R001C00, ACU V200R002C00,S2300, S3300, V100R006C05 and earlier versions,S2700, S3700,S5300, S5700, V100R006,?S6300, S6700 V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions,S7700, S9300, V100R006,S9300E, S9700 V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions,	Version: AC6605,AC6605,ACU,S2300, S3300,S2700, S3700,S5300, S5700,S6300, S6700,S7700, S9300,S9300E, S9700, AC6605 AC6605 V200R001C00, AC6605 V200R002C00,ACU ACU V200R001C00, ACU V200R002C00,S2300, S3300, V100R006C05 and earlier versions,S2700, S3700,S5300, S5700, V100R006,?S6300, S6700 V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions,S7700, S9300, V100R006,S9300E, S9700 V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions,

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:18:48.644Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.huawei.com/en/psirt/security-advisories/hw-373182"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AC6605,AC6605,ACU,S2300, S3300,S2700, S3700,S5300, S5700,S6300, S6700,S7700, S9300,S9300E, S9700, AC6605 AC6605 V200R001C00, AC6605 V200R002C00,ACU ACU V200R001C00, ACU V200R002C00,S2300, S3300, V100R006C05 and earlier versions,S2700, S3700,S5300, S5700, V100R006,?S6300, S6700 V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions,S7700, S9300, V100R006,S9300E, S9700 V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions,",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "AC6605,AC6605,ACU,S2300, S3300,S2700, S3700,S5300, S5700,S6300, S6700,S7700, S9300,S9300E, S9700, AC6605 AC6605 V200R001C00, AC6605 V200R002C00,ACU ACU V200R001C00, ACU V200R002C00,S2300, S3300, V100R006C05 and earlier versions,S2700, S3700,S5300, S5700, V100R006,?S6300, S6700 V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions,S7700, S9300, V100R006,S9300E, S9700 V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions,"
            }
          ]
        }
      ],
      "datePublic": "2017-03-27T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Huawei AC6605 with software V200R001C00; AC6605 with software V200R002C00; ACU with software V200R001C00; ACU with software V200R002C00; S2300, S3300, S2700, S3700 with software V100R006C05 and earlier versions; S5300, S5700, S6300, S6700 with software V100R006, V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions; S7700, S9300, S9300E, S9700 with software V100R006, V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions could allow remote attackers to send a special SSH packet to the VRP device to cause a denial of service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "SSH Denial of Service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-04-02T19:57:01",
        "orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
        "shortName": "huawei"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.huawei.com/en/psirt/security-advisories/hw-373182"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@huawei.com",
          "ID": "CVE-2014-8572",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "AC6605,AC6605,ACU,S2300, S3300,S2700, S3700,S5300, S5700,S6300, S6700,S7700, S9300,S9300E, S9700, AC6605 AC6605 V200R001C00, AC6605 V200R002C00,ACU ACU V200R001C00, ACU V200R002C00,S2300, S3300, V100R006C05 and earlier versions,S2700, S3700,S5300, S5700, V100R006,?S6300, S6700 V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions,S7700, S9300, V100R006,S9300E, S9700 V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions,",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "AC6605,AC6605,ACU,S2300, S3300,S2700, S3700,S5300, S5700,S6300, S6700,S7700, S9300,S9300E, S9700, AC6605 AC6605 V200R001C00, AC6605 V200R002C00,ACU ACU V200R001C00, ACU V200R002C00,S2300, S3300, V100R006C05 and earlier versions,S2700, S3700,S5300, S5700, V100R006,?S6300, S6700 V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions,S7700, S9300, V100R006,S9300E, S9700 V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions,"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Huawei AC6605 with software V200R001C00; AC6605 with software V200R002C00; ACU with software V200R001C00; ACU with software V200R002C00; S2300, S3300, S2700, S3700 with software V100R006C05 and earlier versions; S5300, S5700, S6300, S6700 with software V100R006, V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions; S7700, S9300, S9300E, S9700 with software V100R006, V200R001, V200R002, V200R003, V200R005C00SPC300 and earlier versions could allow remote attackers to send a special SSH packet to the VRP device to cause a denial of service."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "SSH Denial of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.huawei.com/en/psirt/security-advisories/hw-373182",
              "refsource": "CONFIRM",
              "url": "http://www.huawei.com/en/psirt/security-advisories/hw-373182"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
    "assignerShortName": "huawei",
    "cveId": "CVE-2014-8572",
    "datePublished": "2017-04-02T20:00:00",
    "dateReserved": "2014-10-31T00:00:00",
    "dateUpdated": "2024-08-06T13:18:48.644Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted