Security Advisory - Two Vulnerabilities in MGCP Protocol of Some Huawei Products

There is an out-of-bounds read vulnerability in Media Gateway Control Protocol (MGCP) of some Huawei products. An unauthenticated, remote attacker crafts malformed packets with specific parameter to the affected products. Due to insufficient validation of packets, successful exploitation may cause process reboot. (Vulnerability ID: HWPSIRT-2017-08017)

There is an out-of-bounds write vulnerability in Media Gateway Control Protocol (MGCP) of some Huawei products. An unauthenticated, remote attacker crafts malformed packets with specific parameter to the affected products. Due to insufficient validation of packets, successful exploitation may impact availability of product service. (Vulnerability ID: HWPSIRT-2017-08038)

These vulnerabilities have been assigned Common Vulnerabilities and Exposures (CVE) IDs: CVE-2017-17216 and CVE-2017-17217.

Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180124-01-mgcp-en