Security Advisory - Multiple Vulnerabilites in SIP Module on Huawei Products

There is an overflow vulnerability on the SIP module that attacker can exploit by sending a specially crafted SIP message, leading to a process reboot at random. (Vulnerability ID: HWPSIRT-2017-06044)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2017-17142.

There is an overflow vulnerability on the SIP module that the module cannot parse a malformed SIP message when validating variables. Attacker can exploit it to make one process reboot at random. (Vulnerability ID: HWPSIRT-2017-06045)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2017-17143.

There is an overflow vulnerability on the Backup feature of SIP module when the module process a specific amount of state. The module cannot handle it, causing SIP module DoS. (Vulnerability ID: HWPSIRT-2017-06046)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2017-17144.

Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-01-sip-en