cnvd - cnvd-2021-36525

cnvd-2021-36525

Vulnerability from cnvd

Title: Huawei CloudEngine缓冲区溢出漏洞

Description:

Huawei CloudEngine 12800等都是中国华为（Huawei）公司的产品。Huawei CloudEngine 12800是一款12800系列数据中心交换机。Huawei Cloudengine 5800是一款5800系列数据中心交换机。Huawei Cloudengine 6800是一款6800系列数据中心交换机。

Huawei CloudEngine存在缓冲区错误漏洞，该漏洞源于对报文数据未能充分校验，攻击者可利用该漏洞可以通过对目标设备发送篡改的报文方式来触发该漏洞。

Severity: 低

Patch Name: Huawei CloudEngine缓冲区溢出漏洞的补丁

Patch Description:

Huawei CloudEngine存在缓冲区错误漏洞，该漏洞源于对报文数据未能充分校验，攻击者可利用该漏洞可以通过对目标设备发送篡改的报文方式来触发该漏洞。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210519-01-cloudengine-en

Reference: https://www.cybersecurity-help.cz/vdb/SB2021051929

Impacted products

Name
['Huawei CloudEngine 12800 null', 'Huawei CloudEngine 5800 null', 'Huawei CloudEngine 6800 null']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-22362"
    }
  },
  "description": "Huawei CloudEngine 12800\u7b49\u90fd\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Huawei CloudEngine 12800\u662f\u4e00\u6b3e12800\u7cfb\u5217\u6570\u636e\u4e2d\u5fc3\u4ea4\u6362\u673a\u3002Huawei Cloudengine 5800\u662f\u4e00\u6b3e5800\u7cfb\u5217\u6570\u636e\u4e2d\u5fc3\u4ea4\u6362\u673a\u3002Huawei Cloudengine 6800\u662f\u4e00\u6b3e6800\u7cfb\u5217\u6570\u636e\u4e2d\u5fc3\u4ea4\u6362\u673a\u3002\n\nHuawei CloudEngine\u5b58\u5728\u7f13\u51b2\u533a\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5bf9\u62a5\u6587\u6570\u636e\u672a\u80fd\u5145\u5206\u6821\u9a8c\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u53ef\u4ee5\u901a\u8fc7\u5bf9\u76ee\u6807\u8bbe\u5907\u53d1\u9001\u7be1\u6539\u7684\u62a5\u6587\u65b9\u5f0f\u6765\u89e6\u53d1\u8be5\u6f0f\u6d1e\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210519-01-cloudengine-en",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-36525",
  "openTime": "2021-05-22",
  "patchDescription": "Huawei CloudEngine 12800\u7b49\u90fd\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Huawei CloudEngine 12800\u662f\u4e00\u6b3e12800\u7cfb\u5217\u6570\u636e\u4e2d\u5fc3\u4ea4\u6362\u673a\u3002Huawei Cloudengine 5800\u662f\u4e00\u6b3e5800\u7cfb\u5217\u6570\u636e\u4e2d\u5fc3\u4ea4\u6362\u673a\u3002Huawei Cloudengine 6800\u662f\u4e00\u6b3e6800\u7cfb\u5217\u6570\u636e\u4e2d\u5fc3\u4ea4\u6362\u673a\u3002\r\n\r\nHuawei CloudEngine\u5b58\u5728\u7f13\u51b2\u533a\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5bf9\u62a5\u6587\u6570\u636e\u672a\u80fd\u5145\u5206\u6821\u9a8c\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u53ef\u4ee5\u901a\u8fc7\u5bf9\u76ee\u6807\u8bbe\u5907\u53d1\u9001\u7be1\u6539\u7684\u62a5\u6587\u65b9\u5f0f\u6765\u89e6\u53d1\u8be5\u6f0f\u6d1e\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Huawei CloudEngine\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Huawei CloudEngine 12800 null",
      "Huawei CloudEngine 5800 null",
      "Huawei CloudEngine 6800 null"
    ]
  },
  "referenceLink": "https://www.cybersecurity-help.cz/vdb/SB2021051929",
  "serverity": "\u4f4e",
  "submitTime": "2021-05-21",
  "title": "Huawei CloudEngine\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e"
}

CVE-2021-22362 (GCVE-0-2021-22362)

Vulnerability from cvelistv5

Published

2021-05-27 12:18

Modified

2024-08-03 18:44

Severity ?

CWE

Out of Bounds Write

Summary

There is an out of bounds write vulnerability in some Huawei products. An attacker can exploit this vulnerability by sending crafted data in the packet to the target device. Due to insufficient validation of message, successful exploit can cause certain service abnormal.Affected product versions include:CloudEngine 12800 versions V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R019C00SPC800,V200R019C10SPC800;CloudEngine 5800 versions V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R019C00SPC800,V200R019C10SPC800@;CloudEngine 6800 versions V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R005C20SPC800,V200R019C00SPC800,V200R019C10SPC800;CloudEngine 7800 versions V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R019C00SPC800,V200R019C10SPC800.

References

▼	URL	Tags
	https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210519-01-cloudengine-en	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEngine 7800	Version: V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R019C00SPC800,V200R019C10SPC800 Version: V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R005C20SPC800,V200R019C00SPC800,V200R019C10SPC800

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:44:12.387Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210519-01-cloudengine-en"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEngine 7800",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R019C00SPC800,V200R019C10SPC800"
            },
            {
              "status": "affected",
              "version": "V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R005C20SPC800,V200R019C00SPC800,V200R019C10SPC800"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "There is an out of bounds write vulnerability in some Huawei products. An attacker can exploit this vulnerability by sending crafted data in the packet to the target device. Due to insufficient validation of message, successful exploit can cause certain service abnormal.Affected product versions include:CloudEngine 12800 versions V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R019C00SPC800,V200R019C10SPC800;CloudEngine 5800 versions V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R019C00SPC800,V200R019C10SPC800@;CloudEngine 6800 versions V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R005C20SPC800,V200R019C00SPC800,V200R019C10SPC800;CloudEngine 7800 versions V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R019C00SPC800,V200R019C10SPC800."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Out of Bounds Write",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-27T12:18:57",
        "orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
        "shortName": "huawei"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210519-01-cloudengine-en"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@huawei.com",
          "ID": "CVE-2021-22362",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEngine 7800",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R019C00SPC800,V200R019C10SPC800"
                          },
                          {
                            "version_value": "V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R019C00SPC800,V200R019C10SPC800"
                          },
                          {
                            "version_value": "V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R005C20SPC800,V200R019C00SPC800,V200R019C10SPC800"
                          },
                          {
                            "version_value": "V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R019C00SPC800,V200R019C10SPC800"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "There is an out of bounds write vulnerability in some Huawei products. An attacker can exploit this vulnerability by sending crafted data in the packet to the target device. Due to insufficient validation of message, successful exploit can cause certain service abnormal.Affected product versions include:CloudEngine 12800 versions V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R019C00SPC800,V200R019C10SPC800;CloudEngine 5800 versions V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R019C00SPC800,V200R019C10SPC800@;CloudEngine 6800 versions V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R005C20SPC800,V200R019C00SPC800,V200R019C10SPC800;CloudEngine 7800 versions V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R019C00SPC800,V200R019C10SPC800."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Out of Bounds Write"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210519-01-cloudengine-en",
              "refsource": "MISC",
              "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210519-01-cloudengine-en"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
    "assignerShortName": "huawei",
    "cveId": "CVE-2021-22362",
    "datePublished": "2021-05-27T12:18:57",
    "dateReserved": "2021-01-05T00:00:00",
    "dateUpdated": "2024-08-03T18:44:12.387Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted