CVE-2017-17284

Vulnerability

A resource management error exists in the SIP module of multiple Huawei products: DP300 V500R002C00, RP200 V500R002C00 and V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V100R001C01, V100R001C10, V500R002C00, V600R006C00. The vulnerability is triggered when a remote attacker sends a huge number of specially crafted SIP messages. Due to improper handling of some values in the messages, the affected products fail to manage resources correctly, leading to service abnormalities. [1]

Exploitation

An attacker can exploit this vulnerability remotely without authentication. The attacker must be able to send a large volume of specially crafted SIP messages to the target device. The exact sequence involves crafting SIP messages with malicious values that cause resource exhaustion or mismanagement. No user interaction is required. [1]

Impact

Successful exploitation causes some services on the affected products to become abnormal. The impact is primarily availability (denial of service) as services may crash or become unresponsive. No information disclosure or code execution is mentioned. [1]

Mitigation

Huawei has released software updates to fix this vulnerability. For DP300, the resolved version is V500R002C00SPCb00. For other products, the advisory lists resolved versions. Users should upgrade to the fixed versions as indicated in the security advisory. No workarounds are provided. [1]