Security Advisory - Two Vulnerabilities of License Module in Some Huawei Products

There is a uncontrolled format string vulnerability when the license module of some Huawei products output the log information. An authenticated local attacker could exploit this vulnerability to cause a denial of service. (Vulnerability ID: HWPSIRT-2017-06138)

This vulnerability has been assigned a CVE ID: CVE-2017-17132.

There is a null pointer reference vulnerability in license module of some Huawei products due to insufficient verification. An authenticated local attacker could place a malicious license file into system, which cause memory null pointer accessing and related processing crash. The attacker can exploit this vulnerability to cause a denial of service. (Vulnerability ID: HWPSIRT-2017-09100)

This vulnerability has been assigned a CVE ID: CVE-2017-17133.

Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-01-license-en