Integer overflow in Huawei products - CVE-2019-19413

Vulnerability identifier: #VU24341

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-19413

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow in LDAP server. A remote attacker can send a specially crafted packet, trigger integer overflow and cause a denial of service condition on the target system.

Huawei TE60
Huawei TE30
Huawei RP200
Huawei DP300
Huawei TE40
Huawei TE50
Huawei DBS3900 TDD LTE
Huawei CloudEngine 12800
Huawei CloudEngine 5800
Huawei CloudEngine 7800
Huawei CloudEngine 6800

Install updates from vendor's website.

Huawei TE60 - update to TEX0 V600R006C00SPC500
Huawei TE30 - update to TEX0 V600R006C00SPC500
Huawei DBS3900 TDD LTE - update to V100R005C00SPC200
Huawei CloudEngine 12800 - update to V200R003C00SPC810
Huawei CloudEngine 5800 - update to V200R003C00SPC810
Huawei CloudEngine 7800 - update to V200R003C00SPC810
Huawei CloudEngine 6800 - update to V200R003C00SPC810
Huawei RP200 - update to TEX0 V600R006C00SPC500
Huawei DP300 - update to V500R002C00SPCb00
Huawei TE40 - update to TEX0 V600R006C00SPC500
Huawei TE50 - update to TEX0 V600R006C00SPC500

• https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-ldap-en

• Multiple vulnerabilities in some Huawei Products