Lucene search

Huawei TechnologiesHUAWEI-SA-20140423-01-QUIDWAY

HistoryApr 23, 2014 - 12:00 a.m.

Security Advisory-Improper Input Validation Vulnerability on Multiple Quidway Switch Products

2014-04-2300:00:00

Huawei Technologies

www.huawei.com

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

46.2%

JSON

Reported by the internal R&D engineers, several switch products does not validate the input properly. This vulnerability enables attacker to launch DoS attack by crafting and sending malformed packet to these vulnerable products (Vulnerability ID: HWPSIRT-2014-0301).

This Vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2014-3224.

Affected configurations

Vulners

Node

huaweiquidway_s9700_firmwareMatchv200r003c00spc500

huaweiquidway_s9300_firmwareMatchv200r003c00spc500

huaweiquidway_s7700_firmwareMatchv200r003c00spc500

huaweiquidway_s6700_firmwareMatchv200r003c00spc300

huaweiquidway_s6300_firmwareMatchv200r003c00spc300

huaweiquidway_s5700_firmwareMatchv200r003c00spc300

huaweiquidway_s5300_firmwareMatchv200r003c00spc300

VendorProductVersionCPE
huaweiquidway_s9700_firmwarev200r003c00spc500cpe:2.3:o:huawei:quidway_s9700_firmware:v200r003c00spc500:*:*:*:*:*:*:*
huaweiquidway_s9300_firmwarev200r003c00spc500cpe:2.3:o:huawei:quidway_s9300_firmware:v200r003c00spc500:*:*:*:*:*:*:*
huaweiquidway_s7700_firmwarev200r003c00spc500cpe:2.3:o:huawei:quidway_s7700_firmware:v200r003c00spc500:*:*:*:*:*:*:*
huaweiquidway_s6700_firmwarev200r003c00spc300cpe:2.3:o:huawei:quidway_s6700_firmware:v200r003c00spc300:*:*:*:*:*:*:*
huaweiquidway_s6300_firmwarev200r003c00spc300cpe:2.3:o:huawei:quidway_s6300_firmware:v200r003c00spc300:*:*:*:*:*:*:*
huaweiquidway_s5700_firmwarev200r003c00spc300cpe:2.3:o:huawei:quidway_s5700_firmware:v200r003c00spc300:*:*:*:*:*:*:*
huaweiquidway_s5300_firmwarev200r003c00spc300cpe:2.3:o:huawei:quidway_s5300_firmware:v200r003c00spc300:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	quidway_s9700_firmware	v200r003c00spc500	cpe:2.3:o:huawei:quidway_s9700_firmware:v200r003c00spc500:::::::*
huawei	quidway_s9300_firmware	v200r003c00spc500	cpe:2.3:o:huawei:quidway_s9300_firmware:v200r003c00spc500:::::::*
huawei	quidway_s7700_firmware	v200r003c00spc500	cpe:2.3:o:huawei:quidway_s7700_firmware:v200r003c00spc500:::::::*
huawei	quidway_s6700_firmware	v200r003c00spc300	cpe:2.3:o:huawei:quidway_s6700_firmware:v200r003c00spc300:::::::*
huawei	quidway_s6300_firmware	v200r003c00spc300	cpe:2.3:o:huawei:quidway_s6300_firmware:v200r003c00spc300:::::::*
huawei	quidway_s5700_firmware	v200r003c00spc300	cpe:2.3:o:huawei:quidway_s5700_firmware:v200r003c00spc300:::::::*
huawei	quidway_s5300_firmware	v200r003c00spc300	cpe:2.3:o:huawei:quidway_s5300_firmware:v200r003c00spc300:::::::*

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

46.2%

JSON

Related for HUAWEI-SA-20140423-01-QUIDWAY