CVE-2017-17136 Memory corruption in DP300; IPS Module; NGFW Module; NIP6300; NIP6600; RP200; S12700; S1700; S2700; S5700; S6700; S7700; S9700; Secospace USG6300; Secospace USG6500; Secospace USG6600; TE30; TE40; TE50; TE60; TP3106; TP3206; USG9500; ViewPoint 9030
An authenticated local attacker can cause a denial of service via heap overflow in the PEM module of various Huawei network devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-17136?
CVE-2017-17136 is a medium-severity memory corruption vulnerability in Huawei Dp300 Firmware, published on 5 Mar 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
PEM module of Huawei DP300 V500R002C00; IPS Module V500R001C00; V500R001C30; NGFW Module V500R001C00; V500R002C00; NIP6300 V500R001C00; V500R001C30; NIP6600 V500R001C00; V500R001C30; RP200 V500R002C00; V600R006C00; S12700 V200R007C00; V200R007C01; V200R008C00; V200R009C00; V200R010C00; S1700 V200R006C10; V200R009C00; V200R010C00; S2700 V200R006C10; V200R007C00; V200R008C00; V200R009C00; V200R010C00; S5700 V200R006C00; V200R007C00; V200R008C00; V200R009C00; V200R010C00; S6700 V200R008C00; V200R009C00; V200R010C00; S7700 V200R007C00; V200R008C00; V200R009C00; V200R010C00; S9700 V200R007C00; V200R007C01; V200R008C00; V200R009C00; V200R010C00; Secospace USG6300 V500R001C00; V500R001C30; Secospace USG6500 V500R001C00; V500R001C30; Secospace USG6600 V500R001C00; V500R001C30S; TE30 V100R001C02; V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C01; V100R001C10; V500R002C00; V600R006C00; TP3106 V100R002C00; TP3206 V100R002C00; V100R002C10; USG9500 V500R001C00; V500R001C30; ViewPoint 9030 V100R011C02; V100R011C03 has a heap overflow vulnerability due to insufficient verification. An authenticated local attacker can make processing crash by a malicious certificate. The attacker can exploit this vulnerability to cause a denial of service.
Weakness: CWE-119
Which versions are affected by CVE-2017-17136?
It affects 24 products.
Products include Huawei Dp300 Firmware, Huawei Ips Module Firmware, Huawei Ngfw Module Firmware, Huawei Nip6300 Firmware, Huawei Nip6600 Firmware, Huawei Rp200 Firmware and 18 more.
How do I fix CVE-2017-17136?
No fix has been published for CVE-2017-17136 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-17136 being exploited?
There is no known exploitation of CVE-2017-17136 in the wild and no public exploit code.
Other vulnerabilities in Huawei Dp300 Firmware
- CVE-2017-2722 Other in DP300,TE60,TP3106,ViewPoint 9030,eCNS210 TD,eSpace 7950,eSpace IAD,eSpace U1981
- CVE-2017-17146 Memory corruption in DP300
- CVE-2017-17310 Memory corruption in DP300, RP200, TE30, TE40, TE50, TE60
- CVE-2017-15342 Denial of service in DP300,TE60,TP3106,eSpace U1981
- CVE-2017-17168 Other in DP300, RP200, TE30, TE40, TE50, TE60, eSpace U1981
Sources
Also known as GHSA-phgr-76rh-m88v.