Lucene search

[email protected]CVE-2017-15333

HistoryFeb 15, 2018 - 4:29 p.m.

CVE-2017-15333

2018-02-1516:29:00

CWE-20

[email protected]

web.nvd.nist.gov

huawei

xml parser

dos vulnerability

s12700

s1700

s3700

s5700

s6700

s7700

s9700

ecns210_td

v200r005c00

v200r009c00

v200r010c00

nvd

4.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

4.7 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

23.4%

JSON

XML parser in Huawei S12700 V200R005C00,S1700 V200R009C00, V200R010C00,S3700 V100R006C03, V100R006C05,S5700 V200R001C00, V200R002C00, V200R003C00, V200R003C02, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00,S6700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R005C02, V200R008C00, V200R009C00, V200R010C00,S7700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00,S9700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00,eCNS210_TD V100R004C10, V100R004C10SPC003, V100R004C10SPC100, V100R004C10SPC101, V100R004C10SPC102, V100R004C10SPC200, V100R004C10SPC221, V100R004C10SPC400 has a DOS vulnerability. An attacker may craft specific XML files to the affected products. Due to not check the specially XML file and to parse this file, successful exploit will result in DOS attacks.

Affected configurations

NVD

Node

huaweis12700_firmwareMatchv200r005c00

AND

huaweis12700Match-

Node

huaweis1700_firmwareMatchv200r009c00

huaweis1700_firmwareMatchv200r010c00

AND

huaweis1700Match-

Node

huaweis5700_firmwareMatchv200r001c00

huaweis5700_firmwareMatchv200r002c00

huaweis5700_firmwareMatchv200r003c00

huaweis5700_firmwareMatchv200r003c02

huaweis5700_firmwareMatchv200r005c00

huaweis5700_firmwareMatchv200r006c00

huaweis5700_firmwareMatchv200r007c00

huaweis5700_firmwareMatchv200r008c00

huaweis5700_firmwareMatchv200r009c00

huaweis5700_firmwareMatchv200r010c00

AND

huaweis5700Match-

Node

huaweis6700_firmwareMatchv200r001c00

huaweis6700_firmwareMatchv200r002c00

huaweis6700_firmwareMatchv200r003c00

huaweis6700_firmwareMatchv200r005c00

huaweis6700_firmwareMatchv200r005c02

huaweis6700_firmwareMatchv200r008c00

huaweis6700_firmwareMatchv200r009c00

huaweis6700_firmwareMatchv200r010c00

AND

huaweis6700Match-

Node

huaweis6700_firmwareMatchv200r001c00

huaweis6700_firmwareMatchv200r002c00

huaweis6700_firmwareMatchv200r003c00

huaweis6700_firmwareMatchv200r005c00

huaweis6700_firmwareMatchv200r005c02

huaweis6700_firmwareMatchv200r008c00

huaweis6700_firmwareMatchv200r009c00

huaweis6700_firmwareMatchv200r010c00

AND

huaweis6700Match-

Node

huaweis7700_firmwareMatchv200r001c00

huaweis7700_firmwareMatchv200r002c00

huaweis7700_firmwareMatchv200r003c00

huaweis7700_firmwareMatchv200r005c00

huaweis7700_firmwareMatchv200r006c00

huaweis7700_firmwareMatchv200r007c00

huaweis7700_firmwareMatchv200r008c00

huaweis7700_firmwareMatchv200r009c00

huaweis7700_firmwareMatchv200r010c00

AND

huaweis7700Match-

Node

huaweis9700_firmwareMatchv200r001c00

huaweis9700_firmwareMatchv200r002c00

huaweis9700_firmwareMatchv200r003c00

huaweis9700_firmwareMatchv200r005c00

huaweis9700_firmwareMatchv200r006c00

huaweis9700_firmwareMatchv200r007c00

huaweis9700_firmwareMatchv200r008c00

huaweis9700_firmwareMatchv200r009c00

huaweis9700_firmwareMatchv200r010c00

AND

huaweis9700Match-

Node

huaweiecns210_td_firmwareMatchv100r004c10

huaweiecns210_td_firmwareMatchv100r004c10spc003

huaweiecns210_td_firmwareMatchv100r004c10spc100

huaweiecns210_td_firmwareMatchv100r004c10spc101

huaweiecns210_td_firmwareMatchv100r004c10spc102

huaweiecns210_td_firmwareMatchv100r004c10spc200

huaweiecns210_td_firmwareMatchv100r004c10spc221

huaweiecns210_td_firmwareMatchv100r004c10spc400

AND

huaweiecns210_tdMatch-

CPENameOperatorVersion
huawei:s12700_firmwarehuawei s12700 firmwareeqv200r005c00

CPE	Name	Operator	Version
huawei:s12700_firmware	huawei s12700 firmware	eq	v200r005c00

CNA Affected

[
  {
    "product": "S12700, S1700,S3700,S5700,S6700,S7700, S9700, eCNS210_TD",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "S12700 V200R005C00,S1700 V200R009C00, V200R010C00,S3700 V100R006C03, V100R006C05,S5700 V200R001C00, V200R002C00, V200R003C00, V200R003C02, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00,S6700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R005C02, V200R008C00, V200R009C00, V200R010C00,S7700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00,S9700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00,eCNS210_TD V100R004C10, V100R004C10SPC003, V100R004C10SPC100, V100R004C10SPC101, V100R004C10SPC102, V100R004C10SPC200, V100R004C10SPC221, V100R004C10SPC400,"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20171201-01-xml-en

4.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

4.7 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

23.4%

JSON

Related for CVE-2017-15333

cvelist1 prion1 nvd1 openvas2 huawei1