CVE-2019-19414

There is an integer overflow vulnerability in LDAP server of some Huawei products. Due to insufficient input validation, a remote attacker could exploit this vulnerability by sending malformed packets to the target devices. Successful exploit could cause the affected system crash.

CVSS v3 7.5 HIGH
CVSS v2.0 7.8 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

7.8^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-ldap-en	Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-ldap-en	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:huawei:dbs3900_tdd_lte_firmware:v100r003c00:::::::*
	cpe:2.3:o:huawei:dbs3900_tdd_lte_firmware:v100r004c10:::::::*

cpe:2.3:h:huawei:dbs3900_tdd_lte:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:huawei:dp300_firmware:v500r002c00:*:*:*:*:*:*:*

cpe:2.3:h:huawei:dp300:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

OR	cpe:2.3:o:huawei:rp200_firmware:v500r002c00spc200:::::::*
	cpe:2.3:o:huawei:rp200_firmware:v600r006c00:::::::*

cpe:2.3:h:huawei:rp200:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

OR	cpe:2.3:o:huawei:te30_firmware:v100r001c10:::::::*
	cpe:2.3:o:huawei:te30_firmware:v600r006c00:::::::*

cpe:2.3:h:huawei:te30:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:huawei:te40_firmware:v600r006c00:*:*:*:*:*:*:*

cpe:2.3:h:huawei:te40:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:huawei:te50_firmware:v600r006c00:*:*:*:*:*:*:*

cpe:2.3:h:huawei:te50:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND

OR	cpe:2.3:o:huawei:te60_firmware:v100r001c10:::::::*
	cpe:2.3:o:huawei:te60_firmware:v500r002c00:::::::*
	cpe:2.3:o:huawei:te60_firmware:v600r006c00:::::::*

cpe:2.3:h:huawei:te60:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:34

Type	Values Removed	Values Added
References	~~() https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-ldap-en - Vendor Advisory~~	() https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-ldap-en - Vendor Advisory

Information

Published : 2020-01-21 23:15

Updated : 2024-11-21 04:34

NVD link : CVE-2019-19414

Mitre link : CVE-2019-19414

CVE.ORG link : CVE-2019-19414

JSON object : View

Products Affected

huawei

te50
dp300_firmware
te40_firmware
te40
te30
te60
rp200
te50_firmware
dp300
dbs3900_tdd_lte
te60_firmware
dbs3900_tdd_lte_firmware
rp200_firmware
te30_firmware

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2019-19414", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-01-21T23:15:13.367", "references": [{"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-ldap-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}, {"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-ldap-en", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "There is an integer overflow vulnerability in LDAP server of some Huawei products. Due to insufficient input validation, a remote attacker could exploit this vulnerability by sending malformed packets to the target devices. Successful exploit could cause the affected system crash."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de desbordamiento de enteros en el servidor LDAP de algunos productos Huawei. Debido a una comprobaci\u00f3n de entrada insuficiente, un atacante remoto podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo de paquetes malformados hacia los dispositivos de destino. Una explotaci\u00f3n con \u00e9xito podr\u00eda causar el bloqueo del sistema afectado."}], "lastModified": "2024-11-21T04:34:43.830", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:dbs3900_tdd_lte_firmware:v100r003c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "403CCA52-CB4F-4ABC-B7CF-4FAD9E12E1CC"}, {"criteria": "cpe:2.3:o:huawei:dbs3900_tdd_lte_firmware:v100r004c10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFAB4847-06F9-4A7C-9CFD-99DC7635166E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:dbs3900_tdd_lte:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "03FCC014-251D-4BE8-A43E-01456A28AEEC"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:dp300_firmware:v500r002c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8871106B-D3AF-4CFB-A544-1FA411642428"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:dp300:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7F3483B2-9EB6-4E34-900A-945C04A3160D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:rp200_firmware:v500r002c00spc200:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BC535D5-0C05-4695-976F-ACF447431A6F"}, {"criteria": "cpe:2.3:o:huawei:rp200_firmware:v600r006c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "67731A77-1DD4-49B2-B437-2850C9583750"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:rp200:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "98275088-2FBE-42F4-AAEC-DF02950B803D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:te30_firmware:v100r001c10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA3EF476-42D7-4758-8DCB-373F46BF1CF5"}, {"criteria": "cpe:2.3:o:huawei:te30_firmware:v600r006c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "018039EB-7265-4B71-B462-4734FD1D0503"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:te30:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1146F99B-5344-4CD3-AF3F-CD3FE6F6DD91"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:te40_firmware:v600r006c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "931FD3B3-A333-4277-AE55-494F5DB9F09F"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:te40:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "45C3AF58-E030-4E12-A2FD-A4337A5021ED"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:te50_firmware:v600r006c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A70F8924-DC80-4D6F-BA3E-DBFE32FED788"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:te50:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A4F188B3-0A63-4704-9B0D-F8DF5D973FA5"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:te60_firmware:v100r001c10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "092C9FAF-8892-4E16-9C0E-BB1E3488C6C4"}, {"criteria": "cpe:2.3:o:huawei:te60_firmware:v500r002c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "01BC9042-0485-437F-811F-F8898B3B7EA7"}, {"criteria": "cpe:2.3:o:huawei:te60_firmware:v600r006c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A29049D-F472-4772-8750-20730DA624E9"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:te60:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "999117E9-90C8-4E76-90B5-7D364C0B84BF"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}

7.5 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

7.8 /10

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

JSON object

Attach tags to CVE-2019-19414

7.5^/10

7.8^/10

Attach tags to `CVE-2019-19414`