CVE-2017-15339

Vulnerability

The SIP module in multiple Huawei products (including DP300 V500R002C00, IPS Module V100R001C10-V500R001C50, NGFW Module V100R001C10-V500R002C10, and many others) contains a buffer overflow vulnerability [1]. Due to insufficient validation of SIP messages, an attacker can craft specific messages that trigger a buffer overflow in the SIP module's processing code [1]. The affected versions span a wide range of Huawei product lines, including firewalls, NIP series, video conferencing systems, and UC products [1].

Exploitation

An attacker must first find a way to send specially crafted SIP messages to an affected device [1]. This requires network access to the product's SIP service. The attacker does not need authentication; the crafted messages are sent directly to the listening SIP service. The exact sequence involves crafting a SIP message containing a field value that exceeds the expected buffer size, which causes a buffer overflow during processing [1].

Impact

Successful exploitation can cause the affected product's services to behave abnormally, leading to a denial of service (DoS) [1]. The impact is primarily on availability; the overflow disrupts normal SIP processing, potentially causing service interruption until the product is restarted or the malicious traffic stops [1]. No evidence in the references indicates remote code execution or data compromise; the vulnerability is limited to service abnormality [1].

Mitigation

Huawei has released software updates to fix this vulnerability [1]. The fixed versions are available via Huawei's security advisory (huawei-sa-20171201-01-sip) [1]. Users are advised to upgrade to the resolved product and version as specified in the advisory [1]. No workaround is documented, but network administrators can restrict access to the SIP service to trusted hosts as a temporary measure. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the last known release date (2018-04-25) [1].