Security Advisory - Two Vulnerabilities in the SIP Module of Some Huawei Products

There is an out-of-bound read vulnerability in some Huawei products. A remote attacker send specially crafted Session Initiation Protocol (SIP) messages to the affected products. Due to insufficient input validation, successful exploit will cause some services abnormal. (Vulnerability ID: HWPSIRT-2017-08122)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2017-17283.

There is a resource management error vulnerability in some Huawei products. A remote attacker may send huge number of specially crafted SIP messages to the affected products. Due to improper handling of some value in the messages, successful exploit will cause some services abnormal. (Vulnerability ID: HWPSIRT-2017-08123)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2017-17284.

Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180207-02-sip-en