PT-2017-2194 · Juniper Networks · Junos

Publicado 2017-05-30 · Atualizado 2019-10-03 · CVE-2017-2302

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Junos OS versions 12.1X46 prior to 12.1X46-D55 Junos OS versions 12.1X47 prior to 12.1X47-D45 Junos OS versions 12.3R13 prior to 12.3R13 Junos OS versions 12.3X48 prior to 12.3X48-D35 Junos OS versions 13.3 prior to 13.3R10 Junos OS versions 14.1 prior to 14.1R8 Junos OS versions 14.1X53 prior to 14.1X53-D40 Junos OS versions 14.1X55 prior to 14.1X55-D35 Junos OS versions 14.2 prior to 14.2R6 Junos OS versions 15.1 prior to 15.1F2 or 15.1R1 Junos OS versions 15.1X49 prior to 15.1X49-D20

Description The issue is related to the incorrect processing of data by the Junos OS rpd daemon when the BGP add-path feature is enabled with the 'send' option or with both 'send' and 'receive' options. A network-based attacker can cause the Junos OS rpd daemon to crash and restart, potentially resulting in an extended denial of service condition due to repeated crashes.

Recommendations For Junos OS versions 12.1X46 prior to 12.1X46-D55, update to version 12.1X46-D55 or later. For Junos OS versions 12.1X47 prior to 12.1X47-D45, update to version 12.1X47-D45 or later. For Junos OS versions 12.3R13 prior to 12.3R13, update to a later version. For Junos OS versions 12.3X48 prior to 12.3X48-D35, update to version 12.3X48-D35 or later. For Junos OS versions 13.3 prior to 13.3R10, update to version 13.3R10 or later. For Junos OS versions 14.1 prior to 14.1R8, update to version 14.1R8 or later. For Junos OS versions 14.1X53 prior to 14.1X53-D40, update to version 14.1X53-D40 or later. For Junos OS versions 14.1X55 prior to 14.1X55-D35, update to version 14.1X55-D35 or later. For Junos OS versions 14.2 prior to 14.2R6, update to version 14.2R6 or later. For Junos OS versions 15.1 prior to 15.1F2 or 15.1R1, update to version 15.1F2, 15.1R1, or later. For Junos OS versions 15.1X49 prior to 15.1X49-D20, update to version 15.1X49-D20 or later. As a temporary workaround, consider disabling the BGP add-path feature until a patch is available.

Correção

Enumeração de Fraquezas

CWE-19

Identificadores relacionados

BDU:2017-01387

CVE-2017-2302

Produtos afetados

Junos

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-2302 · Nota de Segurança
• https://kb.juniper.net/JSA10771 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-2302 · Aviso do Fabricante
• http://securityfocus.com/bid/95394 · Nota
• https://bdu.fstec.ru/vul/2017-01387 · Nota de Segurança
• http://securitytracker.com/id/1037595 · Nota