CVE-2017-17199

Vulnerability

Several Huawei video conferencing products—including DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10, V500R002C00, V600R006C00; TE40 V500R002C00, V600R006C00; TE50 V500R002C00, V600R006C00; TE60 V100R001C10, V500R002C00, V600R006C00—contain an out-of-bounds read vulnerability in their H.323 message processing. The flaw is triggered when the device processes malformed H.323 reply messages, leading to out-of-bounds memory access [1].

Exploitation

An attacker who controls a server can exploit this vulnerability by sending specially crafted malformed H.323 reply messages to a targeted device. The attacker does not need prior authentication on the target, but must be in a network position to communicate with the device as a server (e.g., via a man-in-the-middle or by luring the device to connect to a malicious server). The malformed message causes the device to read beyond the bounds of an allocated buffer [1].

Impact

Successful exploitation causes the device to read out-of-bounds memory, which can lead to a denial of service condition (service unavailability). The vulnerability does not appear to allow code execution or privilege escalation; the primary impact is on availability [1].

Mitigation

Huawei has released software updates to fix these vulnerabilities. Affected products should be upgraded to the resolved versions listed in the security advisory: DP300 V500R002C00SPCb00; RP200, TE30, TE40, TE50, TE60 should be upgraded to TEX0[1] V600R006C00SPC400 or later. No workarounds have been published; applying the patch is the only recommended mitigation [1].