Security Advisory - Multiple Input Validation Vulnerabilities in CIDAM Protocol on Huawei Products

The CIDAM Protocol on Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol is implemented. An authenticated remote attacker could send a malicious message to a target system. Successful exploit could allow the attacker to tamper with business and make the system abnormal. (Vulnerability ID: HWPSIRT-2017-08147, HWPSIRT-2017-08148, HWPSIRT-2017-08149 and HWPSIRT-2017-08150)

The four vulnerabilities have been assigned four Common Vulnerabilities and Exposures (CVE) IDs: CVE-2017-17168, CVE-2017-17169, CVE-2017-17170 and CVE-2017-17304.

Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-02-cidam-en