CVE-2017-17288

Vulnerability

An integer overflow vulnerability exists in multiple Huawei video collaboration products: DP300 V500R002C00, RP200 V500R002C00 and V600R006C00, TE30 V100R001C10, V500R002C00, and V600R006C00, TE40 V500R002C00 and V600R006C00, TE50 V500R002C00 and V600R006C00, and TE60 V100R001C10, V500R002C00, and V600R006C00 [1]. The flaw occurs when an unauthenticated remote attacker sends specially crafted messages to an affected device. Due to insufficient input validation, the processing of these messages triggers an integer overflow, leading to abnormal behavior in certain processes [1].

Exploitation

An attacker requires network access to the affected product and does not need any prior authentication [1]. The exploitation involves sending specially crafted messages to the target device, which, because of insufficient input validation, causes an integer overflow during message processing [1]. No user interaction is required for the attack to succeed.

Impact

Successful exploitation results in an integer overflow that causes some process abnormal behavior on the affected device [1]. The vulnerability does not lead to remote code execution or direct information disclosure according to the references; the primary outcome is a denial-of-service condition or other process instability.

Mitigation

Huawei has released software updates to fix this vulnerability. Affected products should be upgraded to the following resolved versions: DP300 V500R002C00SPCb00; RP200 and TE30, TE40, TE50, TE60 to the specific versions listed in the advisory, such as TEX0[1] V600R006C00SPC500 and others [1]. The advisory was published on 2018-01-31 [1]. No workarounds are provided.