Prompt

You have not logged in or are not authorized!

Remember my choice for next time?

News Start

Security Advisory-The Firewall Module of SPU Board Information Leakage Vulnerability of Huawei Campus Switch
SA No: Huawei-SA-20130516-01-SPU
Initial Release Date: 05-16-2013
Last Release Date: 07-19-2013

Summary

The Service Process Unit (SPU) is the value-added service card of the Switch. SPU provides services such as load balancing, firewall, Network Address Translation (NAT), IP Security (IPSec), and NetStream. It mainly be deployed in network of carrier and enterprise customers, and provides network security solution and interconnection solution between campuses and private networks.

SPU contains a vulnerability that the users of low priority security zone may visit the contents located in high priority security zone, and it could cause information leakage. The vulnerability is due to improper handling process while the switch works in a specific working model (Vulnerability ID: HWNSIRT-2013-0317).

Currently, this vulnerability has been fixed in Quidway official release.

Affected Products

Products Name

Products Versions

Quidway S7700 SPU

V200R001C00SPC300
V200R001C10SPC300

Quidway S9300 SPU

V200R001C00SPC300
V200R001C10SPC300

Quidway S9700 SPU

V200R001C00SPC300
V200R001C10SPC300

Impact

By exploiting the vulnerability successfully, it may lead to the user in low priority security zone of switch could access to the data existed in high priority security zone, and it causes information leakage.

Vulnerability Scoring Details

The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).

The score of the vulnerability is following:

Base Score: 4.9(AV:N/AC:M/Au:S/C:P/I:N/A:P)

Temporal Score: 4.1 (E:F/RL:O/RC:C)

Overall Score: 4.1

Technical Details

Vulnerability exploitation prerequisites:

  • l The attacker is a legal user of the security zone in switch,
  • l The switch works in the specific model and runs with default configuration between different security zones.

Vulnerability details:

The user in the low priority security zone visits the data located in the high priority security zone.

Temporary Fixes

To prevent the information leakage occurring, modify the default packet filter policy between the security zones. Please refer to the Configuration Guide ‬for detailed info. Below is a configuration example:

1, Configure ACL rules:

[SPU]acl number 2000

[SPU-acl-basic-2000]rule 10 deny

[SPU-acl-basic-2000]quit

2, Apply ACL rules. We assume that the security zones named “trust” and “untrust” are pre-configured in the switch according to users accessing privilege:

[SPU]firewall interzone trust untrust

[SPU-interzone-trust-untrust]firewall enable

[SPU-interzone-trust-untrust]packet-filter 2000 outbound

[SPU-interzone-trust-untrust]packet-filter 2000 inbound

[SPU-interzone-trust-untrust]quit

Software Versions and Fixes

Solution

Modify the default packet filter policy handling process between the security zones to prevent the information leakage vulnerability.

This vulnerability has been fixed in the following version:

Products Name

Products Version

SPU Patches Version

Release Data

Quidway S7700 SPU

V200R001C00SPC300
V200R001C10SPC300

VASP-V200R001SPH003
and later patches

2012-12-31

Quidway S9300 SPU

V200R001C00SPC300
V200R001C10SPC300

VASP-V200R001SPH003
and later patches

2012-12-31

Quidway S9700 SPU

V200R001C00SPC300
V200R001C10SPC300

VASP-V200R001SPH003
and later patches

2012-12-31

Obtaining Fixed Software

Carrier customers please contact Huawei TAC (Huawei Technical Assistance Center) to request the upgrades, and enterprise customers please obtain them through Huawei Enterprise worldwide website at http://support.huawei.com/enterprise/. For TAC contact information, please refer to Huawei worldwide website at http://www.huawei.com/en/security/psirt/report-vulnerabilities/index.htm.

Exploitation and Vulnerability Source

This vulnerability is reported by Huawei internal tester and hasn’t received any impact report. Huawei PSIRT is not aware of any malicious use launched to attack through the vulnerability described in this advisory. 

Contact Channel for Technical Issue

For security problems about Huawei products and solutions, please contact PSIRT@huawei.com

For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.

Revision History

2013-05-16 V1.0 INITIAL

2013-07-19 UPDATED Update software versions display format

Declaration

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei Investment & Holding Co., Ltd. or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.

Huawei Security Procedures

Complete information on providing feedback on security vulnerability of Huawei products, getting support for Huawei security incident response services, and obtaining Huawei security vulnerability information, is available on Huawei's worldwide website at http://www.huawei.com/en/security/psirt/

News End