cnvd - cnvd-2017-37725

CNVD-2017-37725

Vulnerability from cnvd - Published: 2017-12-21

Title

Huawei AR3200和NGFW Module内存泄露漏洞

Description

Huawei AR3200和NGFW Module都是中国华为（Huawei）公司的产品。Huawei AR3200是一款AR3200系列企业路由器产品。NGFW Module是一款防火墙产品。 Huawei AR3200和NGFW Module中存在内存泄露漏洞，该漏洞是由于设备在解析某XML元素时未能合理释放内存。攻击者通过上传特制的XML文件利用该漏洞造成系统服务异常（内存不足）。

Severity

低

Patch Name

Huawei AR3200和NGFW Module内存泄露漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： http://www.huawei.com/cn/psirt/security-advisories/2017/huawei-sa-20171206-04-xml-cn

Reference

http://www.huawei.com/cn/psirt/security-advisories/2017/huawei-sa-20171206-04-xml-cn

Impacted products

Name
['Huawei NGFW Module V500R001C00', 'Huawei AR3200 V200R007C00', 'Huawei AR3200 V200R005C32', 'Huawei AR3200 V200R006C12', 'Huawei AR3200 V200R008C20', 'Huawei AR3200 V200R006C11', 'Huawei AR3200 V200R007C01', 'Huawei AR3200 V200R007C02', 'Huawei AR3200 V200R008C00', 'Huawei AR3200 V200R008C10', 'Huawei AR3200 V200R008C30', 'Huawei NGFW Module V500R001C20', 'Huawei NGFW Module V500R002C00']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-17330"
    }
  },
  "description": "Huawei AR3200\u548cNGFW Module\u90fd\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Huawei AR3200\u662f\u4e00\u6b3eAR3200\u7cfb\u5217\u4f01\u4e1a\u8def\u7531\u5668\u4ea7\u54c1\u3002NGFW Module\u662f\u4e00\u6b3e\u9632\u706b\u5899\u4ea7\u54c1\u3002\r\n\r\nHuawei AR3200\u548cNGFW Module\u4e2d\u5b58\u5728\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8e\u8bbe\u5907\u5728\u89e3\u6790\u67d0XML\u5143\u7d20\u65f6\u672a\u80fd\u5408\u7406\u91ca\u653e\u5185\u5b58\u3002\u653b\u51fb\u8005\u901a\u8fc7\u4e0a\u4f20\u7279\u5236\u7684XML\u6587\u4ef6\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u7cfb\u7edf\u670d\u52a1\u5f02\u5e38\uff08\u5185\u5b58\u4e0d\u8db3\uff09\u3002",
  "discovererName": "Huawei",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://www.huawei.com/cn/psirt/security-advisories/2017/huawei-sa-20171206-04-xml-cn",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-37725",
  "openTime": "2017-12-21",
  "patchDescription": "Huawei AR3200\u548cNGFW Module\u90fd\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Huawei AR3200\u662f\u4e00\u6b3eAR3200\u7cfb\u5217\u4f01\u4e1a\u8def\u7531\u5668\u4ea7\u54c1\u3002NGFW Module\u662f\u4e00\u6b3e\u9632\u706b\u5899\u4ea7\u54c1\u3002\r\n\r\nHuawei AR3200\u548cNGFW Module\u4e2d\u5b58\u5728\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8e\u8bbe\u5907\u5728\u89e3\u6790\u67d0XML\u5143\u7d20\u65f6\u672a\u80fd\u5408\u7406\u91ca\u653e\u5185\u5b58\u3002\u653b\u51fb\u8005\u901a\u8fc7\u4e0a\u4f20\u7279\u5236\u7684XML\u6587\u4ef6\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u7cfb\u7edf\u670d\u52a1\u5f02\u5e38\uff08\u5185\u5b58\u4e0d\u8db3\uff09\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Huawei AR3200\u548cNGFW Module\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Huawei NGFW Module V500R001C00",
      "Huawei AR3200 V200R007C00",
      "Huawei AR3200 V200R005C32",
      "Huawei AR3200 V200R006C12",
      "Huawei AR3200 V200R008C20",
      "Huawei AR3200 V200R006C11",
      "Huawei AR3200 V200R007C01",
      "Huawei AR3200 V200R007C02",
      "Huawei AR3200 V200R008C00",
      "Huawei AR3200 V200R008C10",
      "Huawei AR3200 V200R008C30",
      "Huawei NGFW Module V500R001C20",
      "Huawei NGFW Module V500R002C00"
    ]
  },
  "referenceLink": "http://www.huawei.com/cn/psirt/security-advisories/2017/huawei-sa-20171206-04-xml-cn",
  "serverity": "\u4f4e",
  "submitTime": "2017-12-08",
  "title": "Huawei AR3200\u548cNGFW Module\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2017-17330 (GCVE-0-2017-17330)

Vulnerability from cvelistv5 – Published: 2018-03-09 17:00 – Updated: 2024-08-05 20:51

Summary

Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20; V500R002C00 have a memory leak vulnerability. The software does not release allocated memory properly when parse XML element data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory.

Severity ?

No CVSS data available.

CWE

memory leak

Assigner

huawei

References

URL

Tags

http://www.huawei.com/en/psirt/security-advisorie…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Huawei Technologies Co., Ltd.	AR3200; NGFW Module	Affected: AR3200 V200R005C32 Affected: V200R006C10 Affected: V200R006C11 Affected: V200R007C00 Affected: V200R007C01 Affected: V200R007C02 Affected: V200R008C00 Affected: V200R008C10 Affected: V200R008C20 Affected: V200R008C30 Affected: NGFW Module V500R001C00 Affected: V500R001C20 Affected: V500R002C00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:51:31.072Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AR3200; NGFW Module",
          "vendor": "Huawei Technologies Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "AR3200 V200R005C32"
            },
            {
              "status": "affected",
              "version": "V200R006C10"
            },
            {
              "status": "affected",
              "version": "V200R006C11"
            },
            {
              "status": "affected",
              "version": "V200R007C00"
            },
            {
              "status": "affected",
              "version": "V200R007C01"
            },
            {
              "status": "affected",
              "version": "V200R007C02"
            },
            {
              "status": "affected",
              "version": "V200R008C00"
            },
            {
              "status": "affected",
              "version": "V200R008C10"
            },
            {
              "status": "affected",
              "version": "V200R008C20"
            },
            {
              "status": "affected",
              "version": "V200R008C30"
            },
            {
              "status": "affected",
              "version": "NGFW Module V500R001C00"
            },
            {
              "status": "affected",
              "version": "V500R001C20"
            },
            {
              "status": "affected",
              "version": "V500R002C00"
            }
          ]
        }
      ],
      "datePublic": "2017-12-06T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20; V500R002C00 have a memory leak vulnerability. The software does not release allocated memory properly when parse XML element data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "memory leak",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-09T16:57:01",
        "orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
        "shortName": "huawei"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@huawei.com",
          "ID": "CVE-2017-17330",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "AR3200; NGFW Module",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "AR3200 V200R005C32"
                          },
                          {
                            "version_value": "V200R006C10"
                          },
                          {
                            "version_value": "V200R006C11"
                          },
                          {
                            "version_value": "V200R007C00"
                          },
                          {
                            "version_value": "V200R007C01"
                          },
                          {
                            "version_value": "V200R007C02"
                          },
                          {
                            "version_value": "V200R008C00"
                          },
                          {
                            "version_value": "V200R008C10"
                          },
                          {
                            "version_value": "V200R008C20"
                          },
                          {
                            "version_value": "V200R008C30"
                          },
                          {
                            "version_value": "NGFW Module V500R001C00"
                          },
                          {
                            "version_value": "V500R001C20"
                          },
                          {
                            "version_value": "V500R002C00"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Huawei Technologies Co., Ltd."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20; V500R002C00 have a memory leak vulnerability. The software does not release allocated memory properly when parse XML element data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "memory leak"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en",
              "refsource": "CONFIRM",
              "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-04-xml-en"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
    "assignerShortName": "huawei",
    "cveId": "CVE-2017-17330",
    "datePublished": "2018-03-09T17:00:00",
    "dateReserved": "2017-12-04T00:00:00",
    "dateUpdated": "2024-08-05T20:51:31.072Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-37725

CVE-2017-17330 (GCVE-0-2017-17330)

Tags

Sightings

Nomenclature