Security Advisory - Multiple Vulnerabilities in Some Huawei Products

HWPSIRT-2017-04156:

Successful exploit will result in memory leak of the affected products.

HWPSIRT-2017-04157,HWPSIRT-2017-04158 and HWPSIRT-2017-04169:

Successful exploit will cause some service abnormal.

The vulnerability classification has been performed by using the CVSSv3 scoring system (http://www.first.org/cvss/specification-document).

HWPSIRT-2017-04156,HWPSIRT-2017-04157,HWPSIRT-2017-04158 and HWPSIRT-2017-04169:

Base Score: 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

Temporal Score: 3.1 (E:F/RL:O/RC:C)

HWPSIRT-2017-04156:

This vulnerability can be exploited only when the following conditions are present:

1. The attacker logins to the device.

Vulnerability details:

An authenticated, local attacker may craft a specific XML file to the affected products. Due to not free the memory to parse the XML file, successful exploit will result in memory leak of the affected products.

HWPSIRT-2017-04157:

This vulnerability can be exploited only when the following conditions are present:

1. The attacker logins to the device.

Vulnerability details:

An authenticated attacker may craft a specific XML file to the affected products. Due to improper handling of input, successful exploit will cause some service abnormal.

HWPSIRT-2017-04158:

This vulnerability can be exploited only when the following conditions are present:

1. The attacker logins to the device.

Vulnerability details:

An authenticated attacker may craft a specific XML file to the affected products. Due to insufficient input validation, successful exploit will cause some service abnormal.

HWPSIRT-2017-04169:

This vulnerability can be exploited only when the following conditions are present:

1. The attacker logins to the device.

Vulnerability details:

Due to insufficient input validation, an authenticated, local attacker may craft a specific XML file to the affected products to cause null pointer dereference. Successful exploit will cause some service abnormal.

Customers should contact Huawei TAC (Huawei Technical Assistance Center) to request the upgrades. For TAC contact information, please refer to Huawei worldwide website at http://www.huawei.com/en/psirt/report-vulnerabilities.

This vulnerability was discovered by Huawei internal tester.

2020-09-16 V1.1 UPDATED Updated the "Software Versions and Fixes" section;

2017-12-13 V1.0 INITIAL

None

Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.

To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.

To report a security vulnerability in Huawei products and solutions, please send it to PSIRT@huawei.com. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.