CVE-2016-8782

Huawei CloudEngine 12800 V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00 have a memory leak vulnerability. An unauthenticated attacker may send specific Label Distribution Protocol (LDP) packets to the devices repeatedly. Due to improper validation of some specific fields of the packet, the LDP processing module does not release the memory, resulting in memory leak.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161214-01-ldp-en	Vendor Advisory
http://www.securityfocus.com/bid/94941	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:huawei:cloudengine_12800_firmware:v100r003c00:::::::*
	cpe:2.3:o:huawei:cloudengine_12800_firmware:v100r003c10:::::::*
	cpe:2.3:o:huawei:cloudengine_12800_firmware:v100r005c00:::::::*
	cpe:2.3:o:huawei:cloudengine_12800_firmware:v100r005c10:::::::*
	cpe:2.3:o:huawei:cloudengine_12800_firmware:v100r006c00:::::::*

cpe:2.3:h:huawei:cloudengine_12800:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-03-09 21:29

Updated : 2023-12-10 12:30

NVD link : CVE-2016-8782

Mitre link : CVE-2016-8782

CVE.ORG link : CVE-2016-8782

JSON object : View

Products Affected

huawei

cloudengine_12800
cloudengine_12800_firmware

CWE

CWE-399

Resource Management Errors

{"id": "CVE-2016-8782", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2018-03-09T21:29:00.207", "references": [{"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161214-01-ldp-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}, {"url": "http://www.securityfocus.com/bid/94941", "tags": ["Third Party Advisory", "VDB Entry"], "source": "psirt@huawei.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-399"}]}], "descriptions": [{"lang": "en", "value": "Huawei CloudEngine 12800 V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00 have a memory leak vulnerability. An unauthenticated attacker may send specific Label Distribution Protocol (LDP) packets to the devices repeatedly. Due to improper validation of some specific fields of the packet, the LDP processing module does not release the memory, resulting in memory leak."}, {"lang": "es", "value": "Huawei CloudEngine 12800 V100R003C00, V100R003C10, V100R005C00, V100R005C10 y V100R006C00 tiene una vulnerabilidad de fuga de memoria. Un atacante no autenticado podr\u00eda enviar paquetes LDP (Label Distribution Protocol) a los dispositivos repetidamente. Dada la validaci\u00f3n incorrecta de algunos campos concretos del paquete, el m\u00f3dulo de procesamiento LDP no libera la memoria, lo que resulta en una fuga de memoria."}], "lastModified": "2018-03-26T16:01:51.017", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:cloudengine_12800_firmware:v100r003c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2AEB5929-1526-4910-BE22-07FCDDA06D0B"}, {"criteria": "cpe:2.3:o:huawei:cloudengine_12800_firmware:v100r003c10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C4D77D6-4CCA-45A3-8B8F-2A2E3AD82753"}, {"criteria": "cpe:2.3:o:huawei:cloudengine_12800_firmware:v100r005c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E58D7203-2EE3-412A-B39C-94D82B0BBB98"}, {"criteria": "cpe:2.3:o:huawei:cloudengine_12800_firmware:v100r005c10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71EF4F82-092F-4D19-832B-A174F7D47477"}, {"criteria": "cpe:2.3:o:huawei:cloudengine_12800_firmware:v100r006c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C2DACA5-0AA6-419B-AC6A-8CC19326758E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:cloudengine_12800:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DE8A2875-0F7E-4790-A925-5999396B7578"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}