Lucene search

K
huaweiHuawei TechnologiesHUAWEI-SA-20160907-01-TCP
HistorySep 07, 2016 - 12:00 a.m.

Security Advisory - TCP Connection Hijack Vulnerability

2016-09-0700:00:00
Huawei Technologies
www.huawei.com
37

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

5.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

0.004 Low

EPSS

Percentile

75.1%

There is a vulnerability in the implementation of the RFC 5961, due to the improper determination of the rate of challenge ACK responses by the global rate limit feature. Successful exploit could allow an unauthenticated, remote attacker to reset or hijack into a TCP connections between two systems, resulting in a DoS condition. (Vulnerability ID: HWPSIRT-2016-08060)

This vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2016-5696.

Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:

<http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160907-01-tcp-en&gt;

Affected configurations

Vulners
Node
huaweihuawei_firmwareMatchV100R001C01SPC020
OR
huaweihuawei_firmwareMatchV100R001C01SPC010
OR
huaweihuawei_firmwareMatchV100R001C01SPC010
OR
huaweihuawei_firmwareMatchV100R001C01SPC030
OR
huaweihuawei_firmwareMatchV200R001C01
OR
huaweihuawei_firmwareMatchV300R001C00
OR
saphanaRange<V100R001C01SPC103
OR
huaweioceanstor_18500MatchV300R003C10SPC100
OR
huaweioceanstor_18800MatchV300R003C10SPC100
OR
huaweioceanstor_2800MatchV300R001C00SPH201
OR
huaweioceanstor_5500MatchV300R003C10SPC100
OR
huaweioceanstor_5600_v3MatchV300R003C10SPC100
OR
huaweioceanstor_5800_v3MatchV300R003C10SPC100
OR
huaweioceanstor_5800_v3MatchV300R003C10SPC100
OR
huaweioceanstor_9000MatchV100R001C30
OR
huaweioceanstor_9000MatchV300R005C00
OR
huaweirh1288_v3MatchV100R003C00
OR
huaweirh1288a_v2MatchV100R002C00
OR
huaweirh2288_v3MatchV100R003C00
OR
huaweirh2288a_v2MatchV100R002C00
OR
huaweirh2288h_v3MatchV100R003C00
OR
huaweirh5885_v3_serverMatchV100R003C00
OR
huaweitecal_rh5885h_v3MatchV100R003C10
OR
huaweirh8100_v3MatchV100R003C00
OR
huaweix6800_v3_serverMatchV100R003C00

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

5.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

0.004 Low

EPSS

Percentile

75.1%