This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy

Security Advisory-The Firewall Module of SPU Board Information Leakage Vulnerability of Huawei Campus Switch

  • SA No:Huawei-SA-20130516-01-SPU
  • Initial Release Date: May 16, 2013
  • Last Release Date: Jul 19, 2013

The Service Process Unit (SPU) is the value-added service card of the Switch. SPU provides services such as load balancing, firewall, Network Address Translation (NAT), IP Security (IPSec), and NetStream. It mainly be deployed in network of carrier and enterprise customers, and provides network security solution and interconnection solution between campuses and private networks.

SPU contains a vulnerability that the users of low priority security zone may visit the contents located in high priority security zone, and it could cause information leakage. The vulnerability is due to improper handling process while the switch works in a specific working model (Vulnerability ID: HWNSIRT-2013-0317).

Currently, this vulnerability has been fixed in Quidway official release.

Products Name

Products Versions

Quidway S7700 SPU

V200R001C00SPC300
V200R001C10SPC300

Quidway S9300 SPU

V200R001C00SPC300
V200R001C10SPC300

Quidway S9700 SPU

V200R001C00SPC300
V200R001C10SPC300

By exploiting the vulnerability successfully, it may lead to the user in low priority security zone of switch could access to the data existed in high priority security zone, and it causes information leakage.

The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).

The score of the vulnerability is following:

Base Score: 4.9(AV:N/AC:M/Au:S/C:P/I:N/A:P)

Temporal Score: 4.1 (E:F/RL:O/RC:C)

Overall Score: 4.1

Vulnerability exploitation prerequisites:

  1. The attacker is a legal user of the security zone in switch,

  2. The switch works in the specific model and runs with default configuration between different security zones.

 

Vulnerability details:

  The user in the low priority security zone visits the data located in the high priority security zone. 

To prevent the information leakage occurring, modify the default packet filter policy between the security zones. Please refer to the Configuration Guide for detailed info. Below is a configuration example:

1, Configure ACL rules:

[SPU]acl number 2000                                                                

[SPU-acl-basic-2000]rule 10 deny  

[SPU-acl-basic-2000]quit

2, Apply ACL rules. We assume that the security zones named “trust” and “untrust” are pre-configured in the switch according to users accessing privilege:

[SPU]firewall interzone trust untrust                                                

[SPU-interzone-trust-untrust]firewall enable                                                               

[SPU-interzone-trust-untrust]packet-filter 2000 outbound 

[SPU-interzone-trust-untrust]packet-filter 2000 inbound

[SPU-interzone-trust-untrust]quit


Solution

Modify the default packet filter policy handling process between the security zones to prevent the information leakage vulnerability.

This vulnerability has been fixed in the following version:

 

Products Name

Products Version

SPU Patches Version

Release Data

Quidway S7700 SPU

V200R001C00SPC300
V200R001C10SPC300

VASP-V200R001SPH003
and later patches

2012-12-31

Quidway S9300 SPU

V200R001C00SPC300
V200R001C10SPC300

VASP-V200R001SPH003
and later patches

2012-12-31

Quidway S9700 SPU

V200R001C00SPC300
V200R001C10SPC300

VASP-V200R001SPH003
and later patches

2012-12-31

 


Customers should contact Huawei TAC (Huawei Technical Assistance Center) to request the upgrades. For TAC contact information, please refer to Huawei worldwide website at http://www.huawei.com/en/security/psirt/report-vulnerabilities/index.htm.


This vulnerability is reported by Huawei internal tester and hasn’t received any impact report. Huawei PSIRT is not aware of any malicious use launched to attack through the vulnerability described in this advisory. 

For security problems about Huawei products and solutions, please contactPSIRT@huawei.com.

For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.


2013-05-16 V1.0 INITIAL

2013-07-19 UPDATED Update software versions display format 
This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.


Complete information for providing feedback on security vulnerability of Huawei products, getting support for Huawei security incident response services, and obtaining Huawei security vulnerability information, is available on Huawei's worldwide website at http://www.huawei.com/en/security/psirt/.