CNVD-2017-38283

Vulnerability from cnvd - Published: 2017-12-27
VLAI
Title
多款Huawei产品IKEv2协议内存泄露漏洞
Description
Huawei IPS Module、NGFW Module、NIP6300/6600系列产品及Secospace USG系列都是华为（Huawei）公司面向企业、IDC、校园网和运营商等客户推出的新一代专业入侵防御和防火墙产品。 多款Huawei产品IKEv2协议存在内存泄露漏洞，该漏洞是由于IKEv2对接收的报文内容未能充分校验，导致内存未能释放，系统异常退出。攻击者利用该漏洞造成系统内存泄露，从而导致系统异常。
Severity
低
Patch Name
多款Huawei产品IKEv2协议内存泄露漏洞的补丁
Patch Description
Huawei IPS Module、NGFW Module、NIP6300/6600系列产品及Secospace USG系列都是华为（Huawei）公司面向企业、IDC、校园网和运营商等客户推出的新一代专业入侵防御和防火墙产品。 多款Huawei产品IKEv2协议存在内存泄露漏洞，该漏洞是由于IKEv2对接收的报文内容未能充分校验，导致内存未能释放，系统异常退出。攻击者利用该漏洞造成系统内存泄露，从而导致系统异常。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： http://www.huawei.com/cn/psirt/security-advisories/2017/huawei-sa-20171206-01-ikev2-cn

Reference
http://www.huawei.com/cn/psirt/security-advisories/2017/huawei-sa-20171206-01-ikev2-cn
Impacted products
Name
['Huawei USG9500 V500R001C00SPC200', 'Huawei USG9500 V500R001C00SPC300', 'Huawei USG9500 V500R001C00SPC500', 'Huawei USG9500 V500R001C00SPH303', 'Huawei USG9500 V500R001C00SPH508', 'Huawei USG9500 V500R001C00SPC303', 'Huawei USG9500 V500R001C00SPC500PWE', 'Huawei USG9500 V500R001C20SPC100', 'Huawei USG9500 V500R001C20SPC100PWE', 'Huawei USG9500 V500R001C20SPC200', 'Huawei USG9500 V500R001C20SPC200B062', 'Huawei USG9500 V500R001C20SPC200PWE', 'Huawei USG9500 V500R001C20SPC300B078', 'Huawei USG9500 V500R001C20SPC300PWE', 'Huawei USG9500 V500R001C20SPC101', 'Huawei USG9500 V500R001C20', 'Huawei IPS Module V500R001C00', 'Huawei IPS Module V100R001C20', 'Huawei IPS Module V500R001C00SPC200', 'Huawei IPS Module V500R001C00SPC300', 'Huawei IPS Module V500R001C00SPC500', 'Huawei IPS Module V500R001C00SPH303', 'Huawei IPS Module V500R001C00SPH508', 'Huawei IPS Module V500R001C20SPC100', 'Huawei IPS Module V500R001C20SPC100PWE', 'Huawei IPS Module V500R001C20SPC200', 'Huawei IPS Module V500R001C20SPC200B062', 'Huawei IPS Module V500R001C20SPC200PWE', 'Huawei IPS Module V500R001C20SPC300B078', 'Huawei IPS Module V500R001C20SPC300PWE', 'Huawei NGFW Module V500R001C00', 'Huawei NGFW Module V100R001C20', 'Huawei NGFW Module V500R001C00SPC200', 'Huawei NGFW Module V500R001C00SPC300', 'Huawei NGFW Module V500R001C00SPC500', 'Huawei NGFW Module V500R001C00SPC500PWE', 'Huawei NGFW Module V500R001C00SPH303', 'Huawei NGFW Module V500R001C00SPH508', 'Huawei NGFW Module V500R001C20SPC100', 'Huawei NGFW Module V500R001C20SPC100PWE', 'Huawei NGFW Module V500R001C20SPC200', 'Huawei NGFW Module V500R001C20SPC200B062', 'Huawei NGFW Module V500R001C20SPC200PWE', 'Huawei NGFW Module V500R001C20SPC300B078', 'Huawei NGFW Module V500R001C20SPC300PWE', 'Huawei NIP6300 V500R001C00', 'Huawei NIP6300 V500R001C20', 'Huawei NIP6300 V500R001C20SPC100', 'Huawei NIP6300 V500R001C20SPC100PWE', 'Huawei NIP6300 V500R001C20SPC200B062', 'Huawei NIP6300 V500R001C20SPC200PWE', 'Huawei NIP6300 V500R001C20SPC300B078，V500R001C20SPC300PWE', 'Huawei NIP6300 V500R001C20SPC300B078', 'Huawei NIP6300 V500R001C00SPC200', 'Huawei NIP6300 V500R001C00SPC300', 'Huawei NIP6300 V500R001C00SPC500', 'Huawei NIP6300 V500R001C00SPH303', 'Huawei NIP6300 V500R001C00SPH508', 'Huawei NIP6600 V500R001C00', 'Huawei NIP6600 V500R001C20', 'Huawei NIP6600 V500R001C00SPC200', 'Huawei NIP6600 V500R001C00SPC300', 'Huawei NIP6600 V500R001C00SPC500', 'Huawei NIP6600 V500R001C00SPH303', 'Huawei NIP6600 V500R001C00SPH508', 'Huawei NIP6600 V500R001C20SPC100', 'Huawei NIP6600 V500R001C20SPC100PWE', 'Huawei NIP6600 V500R001C20SPC200B062', 'Huawei NIP6600 V500R001C20SPC200PWE', 'Huawei NIP6600 V500R001C20SPC300B078', 'Huawei Secospace USG6300 V500R001C00', 'Huawei Secospace USG6300 V500R001C20', 'Huawei Secospace USG6300 V500R001C00SPC500PWE', 'Huawei Secospace USG6300 V500R001C00SPC200', 'Huawei Secospace USG6300 V500R001C00SPC300', 'Huawei Secospace USG6300 V500R001C00SPC500', 'Huawei Secospace USG6300 V500R001C00SPH303', 'Huawei Secospace USG6300 V500R001C00SPH508', 'Huawei Secospace USG6300 V500R001C20SPC100', 'Huawei Secospace USG6300 V500R001C20SPC100PWE', 'Huawei Secospace USG6300 V500R001C20SPC200', 'Huawei Secospace USG6300 V500R001C20SPC200B062', 'Huawei Secospace USG6300 V500R001C20SPC200PWE', 'Huawei Secospace USG6300 V500R001C20SPC300B078', 'Huawei Secospace USG6300 V500R001C20SPC300PWE', 'Huawei Secospace USG6300 V500R001C20SPC101', 'Huawei Secospace USG6500 V500R001C00', 'Huawei Secospace USG6500 V500R001C20SPC100', 'Huawei Secospace USG6500 V500R001C20SPC101', 'Huawei Secospace USG6500 V500R001C20SPC200', 'Huawei Secospace USG6500 V100R001C20', 'Huawei Secospace USG6500 V500R001C00SPC500PWE', 'Huawei Secospace USG6500 V500R001C00SPH303', 'Huawei Secospace USG6500 V500R001C00SPH508', 'Huawei Secospace USG6500 V500R001C20SPC100PWE', 'Huawei Secospace USG6500 V500R001C20SPC200B062', 'Huawei Secospace USG6500 V500R001C20SPC200PWE', 'Huawei Secospace USG6500 V500R001C20SPC300B078', 'Huawei Secospace USG6500 V500R001C20SPC300PWE', 'Huawei Secospace USG6500 V500R001C00SPC200', 'Huawei Secospace USG6500 V500R001C00SPC300', 'Huawei Secospace USG6500 V500R001C00SPC500', 'Huawei Secospace USG6600 V500R001C00', 'Huawei Secospace USG6600 V500R001C20SPC100', 'Huawei Secospace USG6600 V500R001C20SPC101', 'Huawei Secospace USG6600 V500R001C20SPC200', 'Huawei Secospace USG6600 V500R001C20SPC200PWE', 'Huawei Secospace USG6600 V500R001C20SPC300', 'Huawei Secospace USG6600 V500R001C00SPC301', 'Huawei Secospace USG6600 V500R001C20SPC500', 'Huawei Secospace USG6600 V500R001C00SPC500PWE', 'Huawei Secospace USG6600 V500R001C00SPH303', 'Huawei Secospace USG6600 V500R001C00SPC100', 'Huawei Secospace USG6600 V500R001C00SPC200', 'Huawei Secospace USG6600 V500R001C20SPC100PWE', 'Huawei Secospace USG6600 V500R001C20SPC300B078', 'Huawei Secospace USG6600 V500R001C20SPC300PWE', 'Huawei Secospace USG6600 V500R001C20', 'Huawei Secospace USG6300 V500R001C20SPC100', 'Huawei Secospace USG6300 V500R001C20SPC101', 'Huawei Secospace USG6300 V500R001C20SPC200', 'Huawei Secospace USG6300 V500R001C20SPC200PWE', 'Huawei NIP6300 V500R001C20SPC200', 'Huawei NIP6600 V500R001C20SPC200']
Show details on source website
To clipboard 

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-17153"
    }
  },
  "description": "Huawei IPS Module\u3001NGFW Module\u3001NIP6300/6600\u7cfb\u5217\u4ea7\u54c1\u53caSecospace USG\u7cfb\u5217\u90fd\u662f\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u9762\u5411\u4f01\u4e1a\u3001IDC\u3001\u6821\u56ed\u7f51\u548c\u8fd0\u8425\u5546\u7b49\u5ba2\u6237\u63a8\u51fa\u7684\u65b0\u4e00\u4ee3\u4e13\u4e1a\u5165\u4fb5\u9632\u5fa1\u548c\u9632\u706b\u5899\u4ea7\u54c1\u3002\r\n\r\n\u591a\u6b3eHuawei\u4ea7\u54c1IKEv2\u534f\u8bae\u5b58\u5728\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8eIKEv2\u5bf9\u63a5\u6536\u7684\u62a5\u6587\u5185\u5bb9\u672a\u80fd\u5145\u5206\u6821\u9a8c\uff0c\u5bfc\u81f4\u5185\u5b58\u672a\u80fd\u91ca\u653e\uff0c\u7cfb\u7edf\u5f02\u5e38\u9000\u51fa\u3002\u653b\u51fb\u8005\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u7cfb\u7edf\u5185\u5b58\u6cc4\u9732\uff0c\u4ece\u800c\u5bfc\u81f4\u7cfb\u7edf\u5f02\u5e38\u3002",
  "discovererName": "Huawei",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://www.huawei.com/cn/psirt/security-advisories/2017/huawei-sa-20171206-01-ikev2-cn",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-38283",
  "openTime": "2017-12-27",
  "patchDescription": "Huawei IPS Module\u3001NGFW Module\u3001NIP6300/6600\u7cfb\u5217\u4ea7\u54c1\u53caSecospace USG\u7cfb\u5217\u90fd\u662f\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u9762\u5411\u4f01\u4e1a\u3001IDC\u3001\u6821\u56ed\u7f51\u548c\u8fd0\u8425\u5546\u7b49\u5ba2\u6237\u63a8\u51fa\u7684\u65b0\u4e00\u4ee3\u4e13\u4e1a\u5165\u4fb5\u9632\u5fa1\u548c\u9632\u706b\u5899\u4ea7\u54c1\u3002\r\n\r\n\u591a\u6b3eHuawei\u4ea7\u54c1IKEv2\u534f\u8bae\u5b58\u5728\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8eIKEv2\u5bf9\u63a5\u6536\u7684\u62a5\u6587\u5185\u5bb9\u672a\u80fd\u5145\u5206\u6821\u9a8c\uff0c\u5bfc\u81f4\u5185\u5b58\u672a\u80fd\u91ca\u653e\uff0c\u7cfb\u7edf\u5f02\u5e38\u9000\u51fa\u3002\u653b\u51fb\u8005\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u7cfb\u7edf\u5185\u5b58\u6cc4\u9732\uff0c\u4ece\u800c\u5bfc\u81f4\u7cfb\u7edf\u5f02\u5e38\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eHuawei\u4ea7\u54c1IKEv2\u534f\u8bae\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Huawei USG9500 V500R001C00SPC200",
      "Huawei USG9500 V500R001C00SPC300",
      "Huawei USG9500 V500R001C00SPC500",
      "Huawei USG9500 V500R001C00SPH303",
      "Huawei USG9500 V500R001C00SPH508",
      "Huawei USG9500 V500R001C00SPC303",
      "Huawei USG9500 V500R001C00SPC500PWE",
      "Huawei USG9500 V500R001C20SPC100",
      "Huawei USG9500 V500R001C20SPC100PWE",
      "Huawei USG9500 V500R001C20SPC200",
      "Huawei USG9500 V500R001C20SPC200B062",
      "Huawei USG9500 V500R001C20SPC200PWE",
      "Huawei USG9500 V500R001C20SPC300B078",
      "Huawei USG9500 V500R001C20SPC300PWE",
      "Huawei USG9500 V500R001C20SPC101",
      "Huawei USG9500 V500R001C20",
      "Huawei IPS Module V500R001C00",
      "Huawei IPS Module V100R001C20",
      "Huawei IPS Module V500R001C00SPC200",
      "Huawei IPS Module V500R001C00SPC300",
      "Huawei IPS Module V500R001C00SPC500",
      "Huawei IPS Module V500R001C00SPH303",
      "Huawei IPS Module V500R001C00SPH508",
      "Huawei IPS Module V500R001C20SPC100",
      "Huawei IPS Module V500R001C20SPC100PWE",
      "Huawei IPS Module V500R001C20SPC200",
      "Huawei IPS Module V500R001C20SPC200B062",
      "Huawei IPS Module V500R001C20SPC200PWE",
      "Huawei IPS Module V500R001C20SPC300B078",
      "Huawei IPS Module V500R001C20SPC300PWE",
      "Huawei NGFW Module V500R001C00",
      "Huawei NGFW Module V100R001C20",
      "Huawei NGFW Module V500R001C00SPC200",
      "Huawei NGFW Module V500R001C00SPC300",
      "Huawei NGFW Module V500R001C00SPC500",
      "Huawei NGFW Module V500R001C00SPC500PWE",
      "Huawei NGFW Module V500R001C00SPH303",
      "Huawei NGFW Module V500R001C00SPH508",
      "Huawei NGFW Module V500R001C20SPC100",
      "Huawei NGFW Module V500R001C20SPC100PWE",
      "Huawei NGFW Module V500R001C20SPC200",
      "Huawei NGFW Module V500R001C20SPC200B062",
      "Huawei NGFW Module V500R001C20SPC200PWE",
      "Huawei NGFW Module V500R001C20SPC300B078",
      "Huawei NGFW Module V500R001C20SPC300PWE",
      "Huawei NIP6300 V500R001C00",
      "Huawei NIP6300 V500R001C20",
      "Huawei NIP6300 V500R001C20SPC100",
      "Huawei NIP6300 V500R001C20SPC100PWE",
      "Huawei NIP6300 V500R001C20SPC200B062",
      "Huawei NIP6300 V500R001C20SPC200PWE",
      "Huawei NIP6300 V500R001C20SPC300B078\uff0cV500R001C20SPC300PWE",
      "Huawei NIP6300 V500R001C20SPC300B078",
      "Huawei NIP6300 V500R001C00SPC200",
      "Huawei NIP6300 V500R001C00SPC300",
      "Huawei NIP6300 V500R001C00SPC500",
      "Huawei NIP6300 V500R001C00SPH303",
      "Huawei NIP6300 V500R001C00SPH508",
      "Huawei NIP6600 V500R001C00",
      "Huawei NIP6600 V500R001C20",
      "Huawei NIP6600 V500R001C00SPC200",
      "Huawei NIP6600 V500R001C00SPC300",
      "Huawei NIP6600 V500R001C00SPC500",
      "Huawei NIP6600 V500R001C00SPH303",
      "Huawei NIP6600 V500R001C00SPH508",
      "Huawei NIP6600 V500R001C20SPC100",
      "Huawei NIP6600 V500R001C20SPC100PWE",
      "Huawei NIP6600 V500R001C20SPC200B062",
      "Huawei NIP6600 V500R001C20SPC200PWE",
      "Huawei NIP6600 V500R001C20SPC300B078",
      "Huawei Secospace USG6300 V500R001C00",
      "Huawei Secospace USG6300 V500R001C20",
      "Huawei Secospace USG6300 V500R001C00SPC500PWE",
      "Huawei Secospace USG6300 V500R001C00SPC200",
      "Huawei Secospace USG6300 V500R001C00SPC300",
      "Huawei Secospace USG6300 V500R001C00SPC500",
      "Huawei Secospace USG6300 V500R001C00SPH303",
      "Huawei Secospace USG6300 V500R001C00SPH508",
      "Huawei Secospace USG6300 V500R001C20SPC100",
      "Huawei Secospace USG6300 V500R001C20SPC100PWE",
      "Huawei Secospace USG6300 V500R001C20SPC200",
      "Huawei Secospace USG6300 V500R001C20SPC200B062",
      "Huawei Secospace USG6300 V500R001C20SPC200PWE",
      "Huawei Secospace USG6300 V500R001C20SPC300B078",
      "Huawei Secospace USG6300 V500R001C20SPC300PWE",
      "Huawei Secospace USG6300 V500R001C20SPC101",
      "Huawei Secospace USG6500 V500R001C00",
      "Huawei Secospace USG6500 V500R001C20SPC100",
      "Huawei Secospace USG6500 V500R001C20SPC101",
      "Huawei Secospace USG6500 V500R001C20SPC200",
      "Huawei Secospace USG6500 V100R001C20",
      "Huawei Secospace USG6500 V500R001C00SPC500PWE",
      "Huawei Secospace USG6500 V500R001C00SPH303",
      "Huawei Secospace USG6500 V500R001C00SPH508",
      "Huawei Secospace USG6500 V500R001C20SPC100PWE",
      "Huawei Secospace USG6500 V500R001C20SPC200B062",
      "Huawei Secospace USG6500 V500R001C20SPC200PWE",
      "Huawei Secospace USG6500 V500R001C20SPC300B078",
      "Huawei Secospace USG6500 V500R001C20SPC300PWE",
      "Huawei Secospace USG6500 V500R001C00SPC200",
      "Huawei Secospace USG6500 V500R001C00SPC300",
      "Huawei Secospace USG6500 V500R001C00SPC500",
      "Huawei Secospace USG6600 V500R001C00",
      "Huawei Secospace USG6600 V500R001C20SPC100",
      "Huawei Secospace USG6600 V500R001C20SPC101",
      "Huawei Secospace USG6600 V500R001C20SPC200",
      "Huawei Secospace USG6600 V500R001C20SPC200PWE",
      "Huawei Secospace USG6600 V500R001C20SPC300",
      "Huawei Secospace USG6600 V500R001C00SPC301",
      "Huawei Secospace USG6600 V500R001C20SPC500",
      "Huawei Secospace USG6600 V500R001C00SPC500PWE",
      "Huawei Secospace USG6600 V500R001C00SPH303",
      "Huawei Secospace USG6600 V500R001C00SPC100",
      "Huawei Secospace USG6600 V500R001C00SPC200",
      "Huawei Secospace USG6600 V500R001C20SPC100PWE",
      "Huawei Secospace USG6600 V500R001C20SPC300B078",
      "Huawei Secospace USG6600 V500R001C20SPC300PWE",
      "Huawei Secospace USG6600 V500R001C20",
      "Huawei Secospace USG6300 V500R001C20SPC100",
      "Huawei Secospace USG6300 V500R001C20SPC101",
      "Huawei Secospace USG6300 V500R001C20SPC200",
      "Huawei Secospace USG6300 V500R001C20SPC200PWE",
      "Huawei NIP6300 V500R001C20SPC200",
      "Huawei NIP6600 V500R001C20SPC200"
    ]
  },
  "referenceLink": "http://www.huawei.com/cn/psirt/security-advisories/2017/huawei-sa-20171206-01-ikev2-cn",
  "serverity": "\u4f4e",
  "submitTime": "2017-12-07",
  "title": "\u591a\u6b3eHuawei\u4ea7\u54c1IKEv2\u534f\u8bae\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.