CVE-2017-17330 (GCVE-0-2017-17330)

Vulnerability from cvelistv5 – Published: 2018-03-09 17:00 – Updated: 2024-08-05 20:51
VLAI?
Summary
Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20; V500R002C00 have a memory leak vulnerability. The software does not release allocated memory properly when parse XML element data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory.
Severity ?
No CVSS data available.
CWE
  • memory leak
Assigner
References
Impacted products
Vendor Product Version
Huawei Technologies Co., Ltd. AR3200; NGFW Module Affected: AR3200 V200R005C32
Affected: V200R006C10
Affected: V200R006C11
Affected: V200R007C00
Affected: V200R007C01
Affected: V200R007C02
Affected: V200R008C00
Affected: V200R008C10
Affected: V200R008C20
Affected: V200R008C30
Affected: NGFW Module V500R001C00
Affected: V500R001C20
Affected: V500R002C00
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:51:31.072Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AR3200; NGFW Module",
          "vendor": "Huawei Technologies Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "AR3200 V200R005C32"
            },
            {
              "status": "affected",
              "version": "V200R006C10"
            },
            {
              "status": "affected",
              "version": "V200R006C11"
            },
            {
              "status": "affected",
              "version": "V200R007C00"
            },
            {
              "status": "affected",
              "version": "V200R007C01"
            },
            {
              "status": "affected",
              "version": "V200R007C02"
            },
            {
              "status": "affected",
              "version": "V200R008C00"
            },
            {
              "status": "affected",
              "version": "V200R008C10"
            },
            {
              "status": "affected",
              "version": "V200R008C20"
            },
            {
              "status": "affected",
              "version": "V200R008C30"
            },
            {
              "status": "affected",
              "version": "NGFW Module V500R001C00"
            },
            {
              "status": "affected",
              "version": "V500R001C20"
            },
            {
              "status": "affected",
              "version": "V500R002C00"
            }
          ]
        }
      ],
      "datePublic": "2017-12-06T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20; V500R002C00 have a memory leak vulnerability. The software does not release allocated memory properly when parse XML element data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "memory leak",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-09T16:57:01",
        "orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
        "shortName": "huawei"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@huawei.com",
          "ID": "CVE-2017-17330",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "AR3200; NGFW Module",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "AR3200 V200R005C32"
                          },
                          {
                            "version_value": "V200R006C10"
                          },
                          {
                            "version_value": "V200R006C11"
                          },
                          {
                            "version_value": "V200R007C00"
                          },
                          {
                            "version_value": "V200R007C01"
                          },
                          {
                            "version_value": "V200R007C02"
                          },
                          {
                            "version_value": "V200R008C00"
                          },
                          {
                            "version_value": "V200R008C10"
                          },
                          {
                            "version_value": "V200R008C20"
                          },
                          {
                            "version_value": "V200R008C30"
                          },
                          {
                            "version_value": "NGFW Module V500R001C00"
                          },
                          {
                            "version_value": "V500R001C20"
                          },
                          {
                            "version_value": "V500R002C00"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Huawei Technologies Co., Ltd."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20; V500R002C00 have a memory leak vulnerability. The software does not release allocated memory properly when parse XML element data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "memory leak"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en",
              "refsource": "CONFIRM",
              "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
    "assignerShortName": "huawei",
    "cveId": "CVE-2017-17330",
    "datePublished": "2018-03-09T17:00:00",
    "dateReserved": "2017-12-04T00:00:00",
    "dateUpdated": "2024-08-05T20:51:31.072Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:huawei:ar3200_firmware:v200r005c32:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7FE26EE9-2331-4D72-96CF-635A0A4EBE3E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:huawei:ar3200_firmware:v200r006c10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DB9A3444-A485-4B87-B910-F3DA5C8E5D74\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:huawei:ar3200_firmware:v200r006c11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B8BE6310-A42C-4BB3-BB02-7CE6F4FF340D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:huawei:ar3200_firmware:v200r007c00:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9752658E-3CF5-4D9E-98FB-D15FD892479C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:huawei:ar3200_firmware:v200r007c01:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0595B3AA-8911-44AF-996B-2F431517FBED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:huawei:ar3200_firmware:v200r007c02:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FC727A7A-CF3D-4DC9-9083-A0CE8ED886A8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:huawei:ar3200_firmware:v200r008c00:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1A842B77-C902-4B20-A171-3F98C75E6160\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:huawei:ar3200_firmware:v200r008c10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AC61DFB2-E24C-4148-892E-A14F1EC3F9CA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:huawei:ar3200_firmware:v200r008c20:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A8D0F6C6-5A87-482B-8B2A-693AC7736CB9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:huawei:ar3200_firmware:v200r008c30:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B01969DE-DC37-4F2F-BB9B-5242810A8317\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:huawei:ar3200:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9309E1AA-0C4E-422C-9307-A8DD0AE5D576\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:huawei:ngfw_module_firmware:v500r001c00:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"80411236-6B22-4937-87F3-E06C991B14D6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:huawei:ngfw_module_firmware:v500r001c20:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1A8E1096-F070-4CE9-B2B4-6368890706A9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:huawei:ngfw_module_firmware:v500r002c00:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F46A81BE-C125-4CAE-8EE1-23177FE0C21E\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:huawei:ngfw_module:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"547D4A9A-6B57-4BBA-9FFE-CF50B9AC5DF4\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20; V500R002C00 have a memory leak vulnerability. The software does not release allocated memory properly when parse XML element data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory.\"}, {\"lang\": \"es\", \"value\": \"Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20 y V500R002C00 tienen una vulnerabilidad de filtrado de memoria. El software no libera la memoria asignada correctamente al analizar los datos de elementos XML. Un atacante autenticado podr\\u00eda subir un archivo XML manipulado, por lo que la explotaci\\u00f3n exitosa de esta vulnerabilidad podr\\u00eda provocar que los servicios del sistema funcionen de manera incorrecta, ya que se quedar\\u00edan sin memoria.\"}]",
      "id": "CVE-2017-17330",
      "lastModified": "2024-11-21T03:17:51.020",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\", \"baseScore\": 3.3, \"baseSeverity\": \"LOW\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 1.4}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:N/I:N/A:P\", \"baseScore\": 2.1, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 3.9, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2018-03-09T17:29:02.330",
      "references": "[{\"url\": \"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en\", \"source\": \"psirt@huawei.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "psirt@huawei.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-772\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2017-17330\",\"sourceIdentifier\":\"psirt@huawei.com\",\"published\":\"2018-03-09T17:29:02.330\",\"lastModified\":\"2024-11-21T03:17:51.020\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20; V500R002C00 have a memory leak vulnerability. The software does not release allocated memory properly when parse XML element data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory.\"},{\"lang\":\"es\",\"value\":\"Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20 y V500R002C00 tienen una vulnerabilidad de filtrado de memoria. El software no libera la memoria asignada correctamente al analizar los datos de elementos XML. Un atacante autenticado podr\u00eda subir un archivo XML manipulado, por lo que la explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda provocar que los servicios del sistema funcionen de manera incorrecta, ya que se quedar\u00edan sin memoria.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":3.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.8,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":2.1,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-772\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:huawei:ar3200_firmware:v200r005c32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7FE26EE9-2331-4D72-96CF-635A0A4EBE3E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:huawei:ar3200_firmware:v200r006c10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB9A3444-A485-4B87-B910-F3DA5C8E5D74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:huawei:ar3200_firmware:v200r006c11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8BE6310-A42C-4BB3-BB02-7CE6F4FF340D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:huawei:ar3200_firmware:v200r007c00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9752658E-3CF5-4D9E-98FB-D15FD892479C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:huawei:ar3200_firmware:v200r007c01:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0595B3AA-8911-44AF-996B-2F431517FBED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:huawei:ar3200_firmware:v200r007c02:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FC727A7A-CF3D-4DC9-9083-A0CE8ED886A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:huawei:ar3200_firmware:v200r008c00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A842B77-C902-4B20-A171-3F98C75E6160\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:huawei:ar3200_firmware:v200r008c10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AC61DFB2-E24C-4148-892E-A14F1EC3F9CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:huawei:ar3200_firmware:v200r008c20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8D0F6C6-5A87-482B-8B2A-693AC7736CB9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:huawei:ar3200_firmware:v200r008c30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B01969DE-DC37-4F2F-BB9B-5242810A8317\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:huawei:ar3200:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9309E1AA-0C4E-422C-9307-A8DD0AE5D576\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:huawei:ngfw_module_firmware:v500r001c00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80411236-6B22-4937-87F3-E06C991B14D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:huawei:ngfw_module_firmware:v500r001c20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A8E1096-F070-4CE9-B2B4-6368890706A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:huawei:ngfw_module_firmware:v500r002c00:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F46A81BE-C125-4CAE-8EE1-23177FE0C21E\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:huawei:ngfw_module:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"547D4A9A-6B57-4BBA-9FFE-CF50B9AC5DF4\"}]}]}],\"references\":[{\"url\":\"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en\",\"source\":\"psirt@huawei.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.