PT-2018-1751 · Juniper Networks · Junos

Publicado 2018-10-10 · Atualizado 2019-10-09 · CVE-2018-0050

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Junos OS versions prior to 14.1R8-S5 Junos OS versions prior to 14.1R9 Junos OS 14.1X53 versions prior to 14.1X53-D48 on QFX Switching Junos OS 14.1X53 versions prior to 14.1X53-D130 on QFabric System Junos OS 14.2 versions prior to 14.2R4

Description The issue is related to an error handling vulnerability in the Routing Protocols Daemon (RPD) of Juniper Networks Junos OS. This vulnerability allows an attacker to cause RPD to crash by sending a malformed MPLS RSVP packet, potentially leading to a sustained Denial of Service condition. The vulnerability requires the packet to be received on an interface configured to receive this type of traffic. It affects IPv4 but not IPv6.

Recommendations For Junos OS versions prior to 14.1R8-S5, update to version 14.1R8-S5 or later. For Junos OS versions prior to 14.1R9, update to version 14.1R9 or later. For Junos OS 14.1X53 versions prior to 14.1X53-D48 on QFX Switching, update to version 14.1X53-D48 or later. For Junos OS 14.1X53 versions prior to 14.1X53-D130 on QFabric System, update to version 14.1X53-D130 or later. For Junos OS 14.2 versions prior to 14.2R4, update to version 14.2R4 or later.

Correção

DoS

RCE

Improper Resource Release

Enumeração de Fraquezas

CWE-20

CWE-404

Identificadores relacionados

BDU:2018-01351

CVE-2018-0050

Produtos afetados

Junos

Referências · 6

• http://securityfocus.com/bid/106206 · Nota
• https://kb.juniper.net/JSA10884 · Aviso do Fabricante
• http://securitytracker.com/id/1041851 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-0050 · Nota de Segurança
• https://bdu.fstec.ru/vul/2018-01351 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-0050 · Aviso do Fabricante