cnvd - cnvd-2017-37725

cnvd-2017-37725

Vulnerability from cnvd

Title: Huawei AR3200和NGFW Module内存泄露漏洞

Description:

Huawei AR3200和NGFW Module都是中国华为（Huawei）公司的产品。Huawei AR3200是一款AR3200系列企业路由器产品。NGFW Module是一款防火墙产品。

Huawei AR3200和NGFW Module中存在内存泄露漏洞，该漏洞是由于设备在解析某XML元素时未能合理释放内存。攻击者通过上传特制的XML文件利用该漏洞造成系统服务异常（内存不足）。

Severity: 低

Patch Name: Huawei AR3200和NGFW Module内存泄露漏洞的补丁

Patch Description:

Huawei AR3200和NGFW Module都是中国华为（Huawei）公司的产品。Huawei AR3200是一款AR3200系列企业路由器产品。NGFW Module是一款防火墙产品。

Huawei AR3200和NGFW Module中存在内存泄露漏洞，该漏洞是由于设备在解析某XML元素时未能合理释放内存。攻击者通过上传特制的XML文件利用该漏洞造成系统服务异常（内存不足）。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： http://www.huawei.com/cn/psirt/security-advisories/2017/huawei-sa-20171206-04-xml-cn

Reference: http://www.huawei.com/cn/psirt/security-advisories/2017/huawei-sa-20171206-04-xml-cn

Impacted products

Name
['Huawei NGFW Module V500R001C00', 'Huawei AR3200 V200R007C00', 'Huawei AR3200 V200R005C32', 'Huawei AR3200 V200R006C12', 'Huawei AR3200 V200R008C20', 'Huawei AR3200 V200R006C11', 'Huawei AR3200 V200R007C01', 'Huawei AR3200 V200R007C02', 'Huawei AR3200 V200R008C00', 'Huawei AR3200 V200R008C10', 'Huawei AR3200 V200R008C30', 'Huawei NGFW Module V500R001C20', 'Huawei NGFW Module V500R002C00']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-17330"
    }
  },
  "description": "Huawei AR3200\u548cNGFW Module\u90fd\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Huawei AR3200\u662f\u4e00\u6b3eAR3200\u7cfb\u5217\u4f01\u4e1a\u8def\u7531\u5668\u4ea7\u54c1\u3002NGFW Module\u662f\u4e00\u6b3e\u9632\u706b\u5899\u4ea7\u54c1\u3002\r\n\r\nHuawei AR3200\u548cNGFW Module\u4e2d\u5b58\u5728\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8e\u8bbe\u5907\u5728\u89e3\u6790\u67d0XML\u5143\u7d20\u65f6\u672a\u80fd\u5408\u7406\u91ca\u653e\u5185\u5b58\u3002\u653b\u51fb\u8005\u901a\u8fc7\u4e0a\u4f20\u7279\u5236\u7684XML\u6587\u4ef6\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u7cfb\u7edf\u670d\u52a1\u5f02\u5e38\uff08\u5185\u5b58\u4e0d\u8db3\uff09\u3002",
  "discovererName": "Huawei",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://www.huawei.com/cn/psirt/security-advisories/2017/huawei-sa-20171206-04-xml-cn",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-37725",
  "openTime": "2017-12-21",
  "patchDescription": "Huawei AR3200\u548cNGFW Module\u90fd\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Huawei AR3200\u662f\u4e00\u6b3eAR3200\u7cfb\u5217\u4f01\u4e1a\u8def\u7531\u5668\u4ea7\u54c1\u3002NGFW Module\u662f\u4e00\u6b3e\u9632\u706b\u5899\u4ea7\u54c1\u3002\r\n\r\nHuawei AR3200\u548cNGFW Module\u4e2d\u5b58\u5728\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8e\u8bbe\u5907\u5728\u89e3\u6790\u67d0XML\u5143\u7d20\u65f6\u672a\u80fd\u5408\u7406\u91ca\u653e\u5185\u5b58\u3002\u653b\u51fb\u8005\u901a\u8fc7\u4e0a\u4f20\u7279\u5236\u7684XML\u6587\u4ef6\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u7cfb\u7edf\u670d\u52a1\u5f02\u5e38\uff08\u5185\u5b58\u4e0d\u8db3\uff09\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Huawei AR3200\u548cNGFW Module\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Huawei NGFW Module V500R001C00",
      "Huawei AR3200 V200R007C00",
      "Huawei AR3200 V200R005C32",
      "Huawei AR3200 V200R006C12",
      "Huawei AR3200 V200R008C20",
      "Huawei AR3200 V200R006C11",
      "Huawei AR3200 V200R007C01",
      "Huawei AR3200 V200R007C02",
      "Huawei AR3200 V200R008C00",
      "Huawei AR3200 V200R008C10",
      "Huawei AR3200 V200R008C30",
      "Huawei NGFW Module V500R001C20",
      "Huawei NGFW Module V500R002C00"
    ]
  },
  "referenceLink": "http://www.huawei.com/cn/psirt/security-advisories/2017/huawei-sa-20171206-04-xml-cn",
  "serverity": "\u4f4e",
  "submitTime": "2017-12-08",
  "title": "Huawei AR3200\u548cNGFW Module\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2017-17330 (GCVE-0-2017-17330)

Vulnerability from cvelistv5

Published

2018-03-09 17:00

Modified

2024-08-05 20:51

Severity ?

CWE

memory leak

Summary

Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20; V500R002C00 have a memory leak vulnerability. The software does not release allocated memory properly when parse XML element data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory.

References

▼	URL	Tags
	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Huawei Technologies Co., Ltd.	AR3200; NGFW Module	Version: AR3200 V200R005C32 Version: V200R006C10 Version: V200R006C11 Version: V200R007C00 Version: V200R007C01 Version: V200R007C02 Version: V200R008C00 Version: V200R008C10 Version: V200R008C20 Version: V200R008C30 Version: NGFW Module V500R001C00 Version: V500R001C20 Version: V500R002C00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:51:31.072Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AR3200; NGFW Module",
          "vendor": "Huawei Technologies Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "AR3200 V200R005C32"
            },
            {
              "status": "affected",
              "version": "V200R006C10"
            },
            {
              "status": "affected",
              "version": "V200R006C11"
            },
            {
              "status": "affected",
              "version": "V200R007C00"
            },
            {
              "status": "affected",
              "version": "V200R007C01"
            },
            {
              "status": "affected",
              "version": "V200R007C02"
            },
            {
              "status": "affected",
              "version": "V200R008C00"
            },
            {
              "status": "affected",
              "version": "V200R008C10"
            },
            {
              "status": "affected",
              "version": "V200R008C20"
            },
            {
              "status": "affected",
              "version": "V200R008C30"
            },
            {
              "status": "affected",
              "version": "NGFW Module V500R001C00"
            },
            {
              "status": "affected",
              "version": "V500R001C20"
            },
            {
              "status": "affected",
              "version": "V500R002C00"
            }
          ]
        }
      ],
      "datePublic": "2017-12-06T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20; V500R002C00 have a memory leak vulnerability. The software does not release allocated memory properly when parse XML element data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "memory leak",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-09T16:57:01",
        "orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
        "shortName": "huawei"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@huawei.com",
          "ID": "CVE-2017-17330",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "AR3200; NGFW Module",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "AR3200 V200R005C32"
                          },
                          {
                            "version_value": "V200R006C10"
                          },
                          {
                            "version_value": "V200R006C11"
                          },
                          {
                            "version_value": "V200R007C00"
                          },
                          {
                            "version_value": "V200R007C01"
                          },
                          {
                            "version_value": "V200R007C02"
                          },
                          {
                            "version_value": "V200R008C00"
                          },
                          {
                            "version_value": "V200R008C10"
                          },
                          {
                            "version_value": "V200R008C20"
                          },
                          {
                            "version_value": "V200R008C30"
                          },
                          {
                            "version_value": "NGFW Module V500R001C00"
                          },
                          {
                            "version_value": "V500R001C20"
                          },
                          {
                            "version_value": "V500R002C00"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Huawei Technologies Co., Ltd."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20; V500R002C00 have a memory leak vulnerability. The software does not release allocated memory properly when parse XML element data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "memory leak"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en",
              "refsource": "CONFIRM",
              "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
    "assignerShortName": "huawei",
    "cveId": "CVE-2017-17330",
    "datePublished": "2018-03-09T17:00:00",
    "dateReserved": "2017-12-04T00:00:00",
    "dateUpdated": "2024-08-05T20:51:31.072Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted