CVE-2017-17135 : What You Need to Know

Huawei Technologies Co., Ltd. products are vulnerable to a null pointer reference issue due to inadequate verification.

Understanding CVE-2017-17135

This CVE involves a vulnerability in various Huawei products that could lead to a denial of service attack.

What is CVE-2017-17135?

The vulnerability in Huawei products allows an authenticated local attacker to exploit a null pointer reference issue by making a specific parameterized call to the PEM decoder.

The Impact of CVE-2017-17135

The vulnerability could result in a denial of service if exploited successfully by an attacker.

Technical Details of CVE-2017-17135

This section provides detailed technical information about the CVE.

Vulnerability Description

The vulnerability is a null pointer reference issue in multiple Huawei products due to insufficient verification.

Affected Systems and Versions

DP300 V500R002C00
IPS Module V500R001C00, V500R001C30
NGFW Module V500R001C00, V500R002C00
NIP6300 V500R001C00, V500R001C30
NIP6600 V500R001C00, V500R001C30
RP200 V500R002C00, V600R006C00
S12700 V200R007C00, V200R007C01, V200R008C00, V200R009C00, V200R010C00
S1700 V200R006C10, V200R009C00, V200R010C00
S2700 V200R006C10, V200R007C00, V200R008C00, V200R009C00, V200R010C00
S5700 V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00
S6700 V200R008C00, V200R009C00, V200R010C00
S7700 V200R007C00, V200R008C00, V200R009C00, V200R010C00
S9700 V200R007C00, V200R007C01, V200R008C00, V200R009C00, V200R010C00
Secospace USG6300 V500R001C00, V500R001C30
Secospace USG6500 V500R001C00, V500R001C30
Secospace USG6600 V500R001C00, V500R001C30S
TE30 V100R001C02, V100R001C10, V500R002C00, V600R006C00
TE40 V500R002C00, V600R006C00
TE50 V500R002C00, V600R006C00
TE60 V100R001C01, V100R001C10, V500R002C00, V600R006C00
TP3106 V100R002C00, TP3206 V100R002C00, V100R002C10
USG9500 V500R001C00, V500R001C30
ViewPoint 9030 V100R011C02, V100R011C03

Exploitation Mechanism

The vulnerability can be exploited by an authenticated local attacker through a specific parameterized call to the PEM decoder.

Mitigation and Prevention

Protect your systems from CVE-2017-17135 with the following steps:

Immediate Steps to Take

Apply vendor-supplied patches or updates.
Monitor for any unusual activity on the affected systems.

Long-Term Security Practices

Regularly update and patch all software and firmware.
Implement strong authentication mechanisms and access controls.

Patching and Updates

Ensure that all affected systems are updated with the latest patches provided by Huawei Technologies Co., Ltd.