Security Advisory- Y.1731 Vulnerability on Some Huawei Switches
- SA No:Huawei-SA-20140317-01
- Initial Release Date: Mar 17, 2014
- Last Release Date: Mar 17, 2014
Y.1731 is an ITU-T recommendation for OAM features on Ethernet-based networks. Y.1731 provides connectivity detection, diagnosis, and performance monitoring for VLAN/VSI services on MANs.
Some Huawei switches support Y.1731 and therefore, has the Y.1731 vulnerability in processing special packets. The vulnerability causes the restart of switches (Vulnerability ID: HWPSIRT-2013-1165).
This Vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2014-3223.
|
Switch series products |
|
|
Products |
Affected versions |
|
S9300 |
V100R006C00SPC500，V100R006C00SPC800 |
|
S2300/S3300/S5300/S6300 |
V100R006C00SPC800,V100R006C01SPC100, V100R006C03 |
An attacker can graft special packets and send them to the switches to cause the switches to restart.
The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).
Base Score: 7.8(AV:N/AC:L/Au:N/C:N/I:N/A:C)
Temporal Score: 6.4 (E:F/RL:O/RC:C)
1. Prerequisite:
The attacker is connected to the switch.
2. Attacking procedure:
The attacker grafts special packets and sends them to the switch to cause the switch to restart.
The following workaround example applies only to the 9300 series product. Other products have no workarounds.
Disable the Y1731 statistics collection function and use the NQA statistics collection function instead. Detailed steps are as follows:
Check whether the Y173.1 reception function is enabled. If yes, disable this function.
[HUAWEI-md-1] display this
cfm md 1
ma 1
map vlan 100
mep mep-id 1 interface GigabitEthernet1/0/45 outward
mep ccm-send mep-id 1 enable
remote-mep mep-id 2
remote-mep ccm-receive mep-id 2 enable
delay-measure one-way receive
delay-measure two-way receive
If the Y173.1 reception function is enabled, disable this function.
[HUAWEI-md1-ma1]undo delay-measure one-way receive
[HUAWEI-md1-ma1]undo delay-measure two-way receive
Check whether the CFM status is up.
In the system view, run the display cfm remote-mep md 1 ma 1 mep-id 2 command.
[HUAWEI]disp cfm remote-mep md 1 ma 1 mep-id 1
MD Name : 1
Level : 0
MA Name : 1
RMEP ID : 1
VLAN ID : 100
VSI Name : --
L2VC ID : --
MAC : 5489-98ee-98f4
CCM Receive : enabled
Trigger-If-Down : disabled
CFM Status : up
Alarm Status : none
Interface TLV : --
Connect Status : up
Create an NQA test.
[HUAWEI]nqa test-instance 1 1
[HUAWEI-nqa-1-1]test-type macping
[HUAWEI-nqa-1-1]probe-count 15
[HUAWEI-nqa-1-1]destination-address remote-mep mep-id 2
[HUAWEI-nqa-1-1]md 1 ma 1
Start the NQA test.
[HUAWEI-nqa-1-1]start now
View the test result.
[HUAWEI-nqa-1-1]display nqa results
NQA entry(1, 1) :testflag is active ,testtype is macping
1 . Test 1 result The test is finished
SendProbe:3 ResponseProbe:3
Completion:success RTD OverThresholds number:0
OWD OverThresholds SD number:0 OWD OverThresholds DS number:0
Min/Max/Avg/Sum RTT:3/4/4/11 RTT Square Sum:41
NumOfRTT:3 Drop operation number:0
Operation sequence errors number:0 RTT Stats errors number:0
System busy operation number:0 Operation timeout number:0
Min Positive SD:1 Min Positive DS:0
Max Positive SD:1 Max Positive DS:0
Positive SD Number:1 Positive DS Number:0
Positive SD Sum:1 Positive DS Sum:0
Positive SD Square Sum:1 Positive DS Square Sum:0
Min Negative SD:0 Min Negative DS:0
Max Negative SD:0 Max Negative DS:0
Negative SD Number:0 Negative DS Number:0
Negative SD Sum:0 Negative DS Sum:0
Negative SD Square Sum:0 Negative DS Square Sum:0
Min Delay SD:0 Min Delay DS:0
Avg Delay SD:0 Avg Delay DS:0
Max Delay SD:0 Max Delay DS:0
Delay SD Square Sum:0 Delay DS Square Sum:0
Packet Loss SD:0 Packet Loss DS:0
Packet Loss Unknown:0 Average of Jitter:1
Average of Jitter SD:0 Average of Jitter DS:0
jitter out value:0.0000000 jitter in value:0.0000000
NumberOfOWD:0 Packet Loss Ratio: 0%
OWD SD Sum:0 OWD DS Sum:0
ICPIF value: 0 MOS-CQ value: 0
TimeStamp unit: ms
Min/Max/Avg/Sum RTT:3/4/4/11 indicates the minimum, maximum, average, and total value of the probe round trip time.
Average of Jitter:1 indicates the average jitter value.
Upgrading version and status:
|
Products |
Solved versions |
Version Status |
|
S9300 V100R006C00SPC800 |
V100R006SPH013 |
Released |
|
S9300 V100R006C00SPC500 |
V100R006SPH013 |
Released |
|
S2300 V1R6C00SPC800 |
S2300 V100R006SPH010 |
Released |
|
S3300 V1R6C00SPC800 |
S3300 V100R006SPH010 |
Released |
|
S5300 V1R6C00SPC800 |
S5300 V100R006SPH010 |
Released |
|
S6300 V1R6C00SPC800 |
S6300 V100R006SPH010 |
Released |
|
S2300 V1R6C01SPC100 |
S2300 V100R006SPH010 |
Released |
|
S3300 V1R6C01SPC100 |
S3300 V100R006SPH010 |
Released |
|
S5300 V1R6C01SPC100 |
S5300 V100R006SPH010 |
Released |
|
S6300 V1R6C01SPC100 |
S6300 V100R006SPH010 |
Released |
|
S2300 V100R006C03 |
S2300 V100R006SPH010 |
Released |
|
S3300 V100R006C03 |
S3300 V100R006SPH010 |
Released |
|
S5300 V100R006C03 |
S5300 V100R006SPH010 |
Released |
|
S6300 V100R006C03 |
S6300 V100R006SPH010 |
Released |
Customers should contact Huawei TAC (Huawei Technical Assistance Center) to request the upgrades, or obtain them through Huawei worldwide website at http://support.huawei.com/support/. For TAC contact information, please refer to Huawei worldwide website at http://www.huawei.com/en/security/psirt/report-vulnerabilities/index.htm.
This vulnerability is found by Huawei internal tester. The Huawei PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
For security problems about Huawei products and solutions, please contact PSIRT@huawei.com.
For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.
2014-03-17 V1.0 INITIAL
This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.
Complete information on providing feedback on security vulnerability of Huawei products, getting support for Huawei security incident response services, and obtaining Huawei security vulnerability information, is available on Huawei's worldwide website at http://www.huawei.com/en/security/psirt/.
