Security Advisory-The Firewall Module of SPU Board Information Leakage Vulnerability of Huawei Campus Switch

By exploiting the vulnerability successfully, it may lead to the user in low priority security zone of switch could access to the data existed in high priority security zone, and it causes information leakage.

The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).

The score of the vulnerability is following:

Base Score: 4.9(AV:N/AC:M/Au:S/C:P/I:N/A:P)

Temporal Score: 4.1 (E:F/RL:O/RC:C)

Overall Score: 4.1

Vulnerability exploitation prerequisites:

  1. The attacker is a legal user of the security zone in switch,

  2. The switch works in the specific model and runs with default configuration between different security zones.

Vulnerability details:

  The user in the low priority security zone visits the data located in the high priority security zone. 

To prevent the information leakage occurring, modify the default packet filter policy between the security zones. Please refer to the Configuration Guide for detailed info. Below is a configuration example:

1, Configure ACL rules:

[SPU]acl number 2000                                                                

[SPU-acl-basic-2000]rule 10 deny  

[SPU-acl-basic-2000]quit

2, Apply ACL rules. We assume that the security zones named “trust” and “untrust” are pre-configured in the switch according to users accessing privilege:

[SPU]firewall interzone trust untrust                                                

[SPU-interzone-trust-untrust]firewall enable                                                               

[SPU-interzone-trust-untrust]packet-filter 2000 outbound 

[SPU-interzone-trust-untrust]packet-filter 2000 inbound

[SPU-interzone-trust-untrust]quit

Solution

Modify the default packet filter policy handling process between the security zones to prevent the information leakage vulnerability.

This vulnerability has been fixed in the following version:

This vulnerability is reported by Huawei internal tester and hasn’t received any impact report. Huawei PSIRT is not aware of any malicious use launched to attack through the vulnerability described in this advisory. 

For security problems about Huawei products and solutions, please contactPSIRT@huawei.com.

For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.

2013-05-16 V1.0 INITIAL

None