PT-2017-1993 · Juniper Networks · Junos

Publicado 2017-04-24 · Atualizado 2017-07-11 · CVE-2017-2340

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Junos OS versions 15.1R3 through 15.1R4 Junos OS version 16.1 prior to 16.1R3

Description The issue exists due to insufficient input validation in a component of the Juniper Networks Junos operating system. This can be exploited by a remote attacker to cause the Packet Forwarding Engine (PFE) to hang or crash. The vulnerability is specifically related to the processing of IPv6 ND packets originating from subscribers and destined to M/MX series routers, particularly when Enhanced Subscriber Management for DHCPv6 subscribers is configured.

Recommendations For Junos OS versions 15.1R3 through 15.1R4, update to a version outside of this range to resolve the issue. For Junos OS version 16.1 prior to 16.1R3, update to version 16.1R3 or later to fix the vulnerability. As a temporary workaround, consider restricting the processing of IPv6 ND packets from subscribers to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2017-01158

CVE-2017-2340

Produtos afetados

Junos

Referências · 6

• https://kb.juniper.net/JSA10786 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-01158 · Nota de Segurança
• http://securitytracker.com/id/1038254 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-2340 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-2340 · Aviso do Fabricante
• http://securityfocus.com/bid/97607 · Nota