This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy (update in May 2018) >

Security Advisory- Y.1731 Vulnerability on Some Huawei Switches

  • SA No:Huawei-SA-20140317-01
  • Initial Release Date: Mar 17, 2014
  • Last Release Date: Mar 17, 2014

Y.1731 is an ITU-T recommendation for OAM features on Ethernet-based networks. Y.1731 provides connectivity detection, diagnosis, and performance monitoring for VLAN/VSI services on MANs.

Some Huawei switches support Y.1731 and therefore, has the Y.1731 vulnerability in processing special packets. The vulnerability causes the restart of switches (Vulnerability ID: HWPSIRT-2013-1165).

This Vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2014-3223.

Switch series products

Products

Affected versions

S9300

V100R006C00SPC500,V100R006C00SPC800

S2300/S3300/S5300/S6300

V100R006C00SPC800,V100R006C01SPC100, V100R006C03

An attacker can graft special packets and send them to the switches to cause the switches to restart.

The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).

Base Score: 7.8(AV:N/AC:L/Au:N/C:N/I:N/A:C)

Temporal Score: 6.4 (E:F/RL:O/RC:C)

1. Prerequisite:

The attacker is connected to the switch.

2. Attacking procedure:

The attacker grafts special packets and sends them to the switch to cause the switch to restart.

The following workaround example applies only to the 9300 series product. Other products have no workarounds.

Disable the Y1731 statistics collection function and use the NQA statistics collection function instead. Detailed steps are as follows:

Check whether the Y173.1 reception function is enabled. If yes, disable this function.

[HUAWEI-md-1] display this

cfm md 1                                                                      

ma 1                                                                          

map vlan 100                                                                

mep mep-id 1 interface GigabitEthernet1/0/45 outward                        

mep ccm-send mep-id 1 enable                                                

remote-mep mep-id 2                                                         

remote-mep ccm-receive mep-id 2 enable                                      

delay-measure one-way receive                                               

delay-measure two-way receive

If the Y173.1 reception function is enabled, disable this function.

[HUAWEI-md1-ma1]undo delay-measure one-way receive

[HUAWEI-md1-ma1]undo delay-measure two-way receive

Check whether the CFM status is up.

In the system view, run the display cfm  remote-mep md 1 ma 1 mep-id 2 command.

[HUAWEI]disp cfm remote-mep md 1 ma 1 mep-id 1                                 

 MD Name            : 1                                                        

 Level              : 0                                                         

 MA Name            : 1                                                        

 RMEP ID            : 1                                                        

 VLAN ID            : 100                                                       

 VSI Name           : --                                                       

 L2VC ID            : --                                                       

 MAC                : 5489-98ee-98f4                                           

 CCM Receive        : enabled                                                  

 Trigger-If-Down    : disabled                                                 

 CFM Status         : up                                                       

 Alarm Status       : none                                                     

 Interface TLV      : --                                                       

 Connect Status     : up  

Create an NQA test.

[HUAWEI]nqa test-instance 1 1                                                           

 [HUAWEI-nqa-1-1]test-type macping                                                             

 [HUAWEI-nqa-1-1]probe-count 15                                                                

 [HUAWEI-nqa-1-1]destination-address remote-mep mep-id 2                                       

 [HUAWEI-nqa-1-1]md 1 ma 1

 

Start the NQA test.

[HUAWEI-nqa-1-1]start now

View the test result.

[HUAWEI-nqa-1-1]display nqa results

 NQA entry(1, 1) :testflag is active ,testtype is macping                      

  1 . Test 1 result   The test is finished                                     

   SendProbe:3                          ResponseProbe:3                        

   Completion:success                   RTD OverThresholds number:0            

   OWD OverThresholds SD number:0       OWD OverThresholds DS number:0         

   Min/Max/Avg/Sum RTT:3/4/4/11         RTT  Square Sum:41                     

   NumOfRTT:3                           Drop operation number:0                 

   Operation sequence errors number:0   RTT Stats errors number:0              

   System busy operation number:0       Operation timeout number:0             

   Min Positive SD:1                    Min Positive DS:0                      

   Max Positive SD:1                    Max Positive DS:0                      

   Positive SD Number:1                 Positive DS Number:0                   

   Positive SD Sum:1                    Positive DS Sum:0                      

   Positive SD Square Sum:1             Positive DS Square Sum:0               

   Min Negative SD:0                    Min Negative DS:0                      

   Max Negative SD:0                    Max Negative DS:0                      

   Negative SD Number:0                 Negative DS Number:0                   

   Negative SD Sum:0                    Negative DS Sum:0                      

   Negative SD Square Sum:0             Negative DS Square Sum:0               

   Min Delay SD:0                       Min Delay DS:0                         

   Avg Delay SD:0                       Avg Delay DS:0                         

   Max Delay SD:0                       Max Delay DS:0                         

   Delay SD Square Sum:0                Delay DS Square Sum:0                  

   Packet Loss SD:0                     Packet Loss DS:0                       

   Packet Loss Unknown:0                Average of Jitter:1                    

   Average of Jitter SD:0               Average of Jitter DS:0                 

   jitter out value:0.0000000           jitter in value:0.0000000              

   NumberOfOWD:0                        Packet Loss Ratio: 0%                  

   OWD SD Sum:0                         OWD DS Sum:0                            

   ICPIF value: 0                       MOS-CQ value: 0                        

   TimeStamp unit: ms                                           

 

Min/Max/Avg/Sum RTT:3/4/4/11 indicates the minimum, maximum, average, and total value of the probe round trip time.

Average of Jitter:1 indicates the average jitter value. 


Upgrading version and status:

Products

Solved versions

Version Status

S9300 V100R006C00SPC800

V100R006SPH013

Released

S9300 V100R006C00SPC500

V100R006SPH013

Released

S2300 V1R6C00SPC800

S2300 V100R006SPH010

Released

S3300 V1R6C00SPC800

S3300 V100R006SPH010

Released

S5300 V1R6C00SPC800

S5300 V100R006SPH010

Released

S6300 V1R6C00SPC800

S6300 V100R006SPH010

Released

S2300 V1R6C01SPC100

S2300 V100R006SPH010

Released

S3300 V1R6C01SPC100

S3300 V100R006SPH010

Released

S5300 V1R6C01SPC100

S5300 V100R006SPH010

Released

S6300 V1R6C01SPC100

S6300 V100R006SPH010

Released

S2300 V100R006C03

S2300 V100R006SPH010

Released

S3300  V100R006C03

S3300 V100R006SPH010

Released

S5300  V100R006C03

S5300 V100R006SPH010

Released

S6300  V100R006C03

S6300 V100R006SPH010

Released


Customers should contact Huawei TAC (Huawei Technical Assistance Center) to request the upgrades, or obtain them through Huawei worldwide website at http://support.huawei.com/support/. For TAC contact information, please refer to Huawei worldwide website at http://www.huawei.com/en/security/psirt/report-vulnerabilities/index.htm.


This vulnerability is found by Huawei internal tester. The Huawei PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.


For security problems about Huawei products and solutions, please contact PSIRT@huawei.com.

For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.


2014-03-17 V1.0 INITIAL

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.


Complete information on providing feedback on security vulnerability of Huawei products, getting support for Huawei security incident response services, and obtaining Huawei security vulnerability information, is available on Huawei's worldwide website at http://www.huawei.com/en/security/psirt/.