Security Advisory - Memory Leak Vulnerability in Huawei Switches

When serving as an HTTPS or SFTP server, the Huawei switch stores a user’s SSL session information in the memory even after the user logs out. If the memory occupied by the SSL session information exceeds the allocated amount, memory leak occurs, causing the device to restart. (Vulnerability ID: HWPSIRT-2015-11035)

This vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2015-8677.

Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160113-03-switch-en