Huawei TE60/ViewPoint 9030 LDAP Server LDAP Connection resource management

CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
6.4 | $0-$5k | 0.00 |
A vulnerability has been found in Huawei TE60 and ViewPoint 9030 (Unified Communication Software) (version now known) and classified as problematic. Affected by this vulnerability is some unknown processing of the component LDAP Server. The manipulation as part of a LDAP Connection leads to a resource management vulnerability. The CWE definition for the vulnerability is CWE-399. As an impact it is known to affect availability. The summary by CVE is:
The Light Directory Access Protocol (LDAP) clients of Huawei TE60 with software V600R006C00, ViewPoint 9030 with software V100R011C02, V100R011C03 have a resource management errors vulnerability. An unauthenticated, remote attacker may make the LDAP server not respond to the client's request by controlling the LDAP server. Due to improper management of LDAP connection resource, a successful exploit may cause the connection resource exhausted of the LDAP client.
The bug was discovered 12/13/2017. The weakness was presented 02/15/2018 (Website). The advisory is shared at huawei.com. This vulnerability is known as CVE-2017-17290 since 12/04/2017. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/08/2023).
The vulnerability was handled as a non-public zero-day exploit for at least 64 days. During that time the estimated underground price was around $5k-$25k.
There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.
Product
Type
Vendor
Name
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.4VulDB Meta Temp Score: 6.4
VulDB Base Score: 5.3
VulDB Temp Score: 5.3
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 7.5
NVD Vector: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Resource managementCWE: CWE-399 / CWE-404
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: no mitigation knownStatus: 🔍
0-Day Time: 🔍
Timeline
12/04/2017 🔍12/13/2017 🔍
02/15/2018 🔍
02/15/2018 🔍
02/16/2018 🔍
02/08/2023 🔍
Sources
Vendor: huawei.comAdvisory: sa-20171213-01
Status: Not defined
Confirmation: 🔍
CVE: CVE-2017-17290 (🔍)
Entry
Created: 02/16/2018 12:41 PMUpdated: 02/08/2023 09:32 AM
Changes: 02/16/2018 12:41 PM (57), 01/05/2020 07:38 PM (2), 02/08/2023 09:32 AM (3)
Complete: 🔍
Cache ID: 18:85E:40
No comments yet. Languages: en.
Please log in to comment.