Este site utiliza cookies. Ao continuar navegando no site, você concorda com esse uso. Leia nossa política de privacidade

Corporativo Brasil [alterar]
Corporativo
Sobre a Huawei, Imprensa e Eventos e mais
Pessoal
Celulares, Computadores e Tablets, utensílios e mais
Enterprise
Produtos, soluções e serviços para empresas
Carrier
Produtos, soluções e serviços para operadoras
Huawei Cloud
Produtos e soluções baseados nos serviços da Huawei Cloud

Select a Country or Region

Security Advisory - DoS Vulnerability in Huawei CE Series Switches

  • SA No:Huawei-SA-20160113-01-Switch
  • Initial Release Date: 2016-01-13
  • Last Release Date: 2016-01-13

Huawei CE series switches are high-performance switches designed for next-generation data centers.

The CE series switches have a DoS vulnerability. An attacker logs in to the switches multiple times using a non-administrator account through a specific protocol to exploit this vulnerability. Successful exploitation can cause the device to restart. (Vulnerability ID: HWPSIRT-2015-11063)

 

Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160113-01-switch-en

Product Name

Affected Version

Resolved Product and Version

CloudEngine 12800

V100R005C00

V100R005SPH003

An attacker can exploit this vulnerability to launch a DoS attack to a device, causing it to restart.

The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).

Base Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Temporal Score: 3.3 (E:F/RL:O/RC:C)

Prerequisite:

1.The attacker has logged in to a CE switch using a non-administrator account through a specific protocol.

 

Attacking procedure:

A server can identify administrator accounts and forcibly log out non-administrator users. Besides, the server does not restrict the login times of non-administrator accounts. The attacker can log in to a CE switch multiple times using a non-administrator account through a specific protocol to launch a DoS attack to the CE switch, causing it to restart.

None


Customers should contact Huawei TAC (Huawei Technical Assistance Center) to request the upgrades. For TAC contact information, please refer to Huawei worldwide website at http://www.huawei.com/en/psirt/report-vulnerabilities/index.htm

This vulnerability was reported by Huawei internal tester.

2016-01-13 V1.0 INITIAL

None


Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism. Please report to Huawei PSIRT at psirt@huawei.com if you find any security vulnerability of Huawei products.

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.