Security Advisory - Several Vulnerabilities in H323 Protocol of Huawei Products

There are three null pointer dereference vulnerabilities in H323 protocol of Huawei products. An unauthenticated, remote attacker could craft malformed packets and send the packets to the affected products. Due to insufficient validation of packets, which could be exploited to cause process crash. (Vulnerability ID: HWPSIRT-2017-06286,HWPSIRT-2017-06299 and HWPSIRT-2017-06300)

The three vulnerabilities have been assigned three Common Vulnerabilities and Exposures (CVE) IDs: CVE-2017-17251, CVE-2017-17254 and CVE-2017-17255.

There are two out-of-bounds read vulnerabilities in H323 protocol of Huawei products. An unauthenticated, remote attacker could craft malformed packets with specific parameters and send the packets to the affected products. Due to insufficient validation of packets, which could be exploited to cause process crash. (Vulnerability ID: HWPSIRT-2017-06297 and HWPSIRT-2017-06298)

The two vulnerabilities have been assigned two Common Vulnerabilities and Exposures (CVE) IDs: CVE-2017-17252 and CVE-2017-17253.

There are several memory leak vulnerabilities in H323 protocol of Huawei products. An unauthenticated, remote attacker could craft malformed packets and send the packets to the affected products. Due to insufficient verification of the packets, successful exploit could cause a memory leak and eventual denial of service (DoS) condition. (Vulnerability ID: HWPSIRT-2017-06301 and HWPSIRT-2017-06302)

The two vulnerabilities have been assigned two Common Vulnerabilities and Exposures (CVE) IDs: CVE-2017-17256 and CVE-2017-17257.

There is a resource management vulnerability in H323 protocol of Huawei products. An unauthenticated, remote attacker could craft malformed packets and send the packets to the affected products in the case of failure to apply for memory. Due to insufficient validation of packets, which could be exploited to cause process crash. (Vulnerability ID: HWPSIRT-2017-06303)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2017-17258.

Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171227-01-h323-en