PT-2017-15337 · Juniper Networks · Qfx3600+6

Published 2017-05-30 · Updated 2019-05-10 · CVE-2017-2304

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300, and EX4600 devices running Junos OS versions prior to 14.1X53-D40 Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300, and EX4600 devices running Junos OS versions prior to 15.1X53-D40 Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300, and EX4600 devices running Junos OS versions prior to 15.1R2

Description The issue, also known as 'Etherleak', occurs because the devices do not pad Ethernet packets with zeros. As a result, some packets can contain fragments of system memory or data from previous packets.

Recommendations For Junos OS 14.1X53, update to version 14.1X53-D40 or later. For Junos OS 15.1X53, update to version 15.1X53-D40 or later. For Junos OS 15.1, update to version 15.1R2 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-2304

Affected Products

Ex4300

Ex4600

Junos

Qfx3500

Qfx3600

Qfx5100

Qfx5200

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-2304 · Security Note
• https://osv.dev/vulnerability/CVE-2017-2304 · Vendor Advisory
• https://kb.juniper.net/JSA10773 · Vendor Advisory
• http://securitytracker.com/id/1037593 · Note
• http://securityfocus.com/bid/95403 · Note