PT-2014-7199 · Juniper Networks · Junos

Published 2014-10-14 · Updated 2017-09-08 · CVE-2014-6378

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Juniper Junos versions 11.4 through 12.1X44 before D35 Juniper Junos versions 12.1X45 through 12.1X45 before D30 Juniper Junos versions 12.1X46 through 12.1X46 before D25 Juniper Junos versions 12.1X47 through 12.1X47 before D10 Juniper Junos versions 12.2 through 12.2 before R9 Juniper Junos versions 12.2X50 through 12.2X50 before D70 Juniper Junos versions 12.3 through 12.3 before R7 Juniper Junos versions 13.1 through 13.1 before R4 before S3 Juniper Junos versions 13.1X49 through 13.1X49 before D55 Juniper Junos versions 13.1X50 through 13.1X50 before D30 Juniper Junos versions 13.2 through 13.2 before R5 Juniper Junos versions 13.2X50 through 13.2X50 before D20 Juniper Junos versions 13.2X51 through 13.2X51 before D26 and D30 Juniper Junos versions 13.2X52 through 13.2X52 before D15 Juniper Junos versions 13.3 through 13.3 before R3 Juniper Junos versions 14.1 through 14.1 before R1

Description The issue allows remote attackers to cause a denial of service via a crafted RSVP PATH message, resulting in a router protocol daemon crash.

Recommendations For Juniper Junos versions 11.4 through 12.1X44 before D35, update to a version after D35. For Juniper Junos versions 12.1X45 through 12.1X45 before D30, update to a version after D30. For Juniper Junos versions 12.1X46 through 12.1X46 before D25, update to a version after D25. For Juniper Junos versions 12.1X47 through 12.1X47 before D10, update to a version after D10. For Juniper Junos versions 12.2 through 12.2 before R9, update to a version after R9. For Juniper Junos versions 12.2X50 through 12.2X50 before D70, update to a version after D70. For Juniper Junos versions 12.3 through 12.3 before R7, update to a version after R7. For Juniper Junos versions 13.1 through 13.1 before R4 before S3, update to a version after R4 before S3. For Juniper Junos versions 13.1X49 through 13.1X49 before D55, update to a version after D55. For Juniper Junos versions 13.1X50 through 13.1X50 before D30, update to a version after D30. For Juniper Junos versions 13.2 through 13.2 before R5, update to a version after R5. For Juniper Junos versions 13.2X50 through 13.2X50 before D20, update to a version after D20. For Juniper Junos versions 13.2X51 through 13.2X51 before D26 and D30, update to a version after D26 and D30. For Juniper Junos versions 13.2X52 through 13.2X52 before D15, update to a version after D15. For Juniper Junos versions 13.3 through 13.3 before R3, update to a version after R3. For Juniper Junos versions 14.1 through 14.1 before R1, update to a version after R1.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2014-6378

Affected Products

Junos

References · 5

• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10652 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-6378 · Security Note
• http://securityfocus.com/bid/70363 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96906 · Note
• http://securitytracker.com/id/1031008 · Note