Lucene search

K
huaweiHuawei TechnologiesHUAWEI-SA-20160824-01-VRP
HistoryAug 24, 2016 - 12:00 a.m.

Security Advisory - Uncontrolled Format String Vulnerability on Multiple Products

2016-08-2400:00:00
Huawei Technologies
www.huawei.com
20

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:N/I:N/A:C

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.002 Low

EPSS

Percentile

51.6%

Several Huawei routers and switches have an uncontrolled format string vulnerability when processing partial commands. An authenticated attacker could exploit this vulnerability to cause a denial of service. (Vulnerability ID: HWPSIRT-2016-07011)

This vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2016-6901.

Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:
<http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160824-01-vrp-en&gt;

Affected configurations

Vulners
Node
huaweiar100MatchV200R005
OR
huaweiar120MatchV200R005
OR
huaweiar150MatchV200R005
OR
huaweiar200MatchV200R005
OR
huaweiar500MatchV200R005
OR
huaweiar550MatchV200R005
OR
huaweiar1200MatchV200R005
OR
huaweiar2200MatchV200R005
OR
huaweiar2500MatchV200R005
OR
huaweiar3200MatchV200R005
OR
huaweiar3600MatchV200R005
OR
huaweiar100MatchV200R006
OR
huaweiar120MatchV200R006
OR
huaweiar150MatchV200R006
OR
huaweiar200MatchV200R006
OR
huaweiar500MatchV200R006
OR
huaweiar550MatchV200R006
OR
huaweiar1200MatchV200R006
OR
huaweiar2200MatchV200R006
OR
huaweiar2500MatchV200R006
OR
huaweiar3200MatchV200R006
OR
huaweiar3600MatchV200R006
OR
huaweiar100MatchV200R007C00
OR
huaweiar120MatchV200R007C00
OR
huaweiar150MatchV200R007C00
OR
huaweiar200MatchV200R007C00
OR
huaweiar500MatchV200R007C00
OR
huaweiar550MatchV200R007C00
OR
huaweiar1200MatchV200R007C00
OR
huaweiar2200MatchV200R007C00
OR
huaweiar2500MatchV200R007C00
OR
huaweiar3200MatchV200R007C00
OR
huaweiar3600MatchV200R007C00
OR
huaweinetengine_16exMatchV200R005
OR
huaweinetengine_16exMatchV200R006
OR
huaweinetengine_16exMatchV200R007C00

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:N/I:N/A:C

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.002 Low

EPSS

Percentile

51.6%

Related for HUAWEI-SA-20160824-01-VRP