PT-2017-1973 · Juniper Networks · Junos

Published 2017-04-24 · Updated 2017-07-11 · CVE-2017-2313

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Junos OS versions prior to 15.1F2-S15, 15.1F5-S7, 15.1F6-S5, 15.1F7, 15.1R4-S7, 15.1R5-S2, 15.1R6 Junos OS versions 15.1X49 prior to 15.1X49-D78, 15.1X49-D80 Junos OS versions 15.1X53 prior to 15.1X53-D230, 15.1X53-D63, 15.1X53-D70 Junos OS versions 16.1 prior to 16.1R3-S3, 16.1R4 Junos OS versions 16.2 prior to 16.2R1-S3, 16.2R2

Description The issue is caused by insufficient input validation in the Junos OS, which can be exploited by a remote attacker to cause a crash and restart of the device or a denial of service condition through the routing process daemon. Repeated crashes of the rpd daemon can result in an extended denial of service condition.

Recommendations For Junos OS versions prior to 15.1F2-S15, 15.1F5-S7, 15.1F6-S5, 15.1F7, 15.1R4-S7, 15.1R5-S2, 15.1R6, update to a fixed version. For Junos OS versions 15.1X49 prior to 15.1X49-D78, 15.1X49-D80, update to a fixed version. For Junos OS versions 15.1X53 prior to 15.1X53-D230, 15.1X53-D63, 15.1X53-D70, update to a fixed version. For Junos OS versions 16.1 prior to 16.1R3-S3, 16.1R4, update to a fixed version. For Junos OS versions 16.2 prior to 16.2R1-S3, 16.2R2, update to a fixed version.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2017-01133

CVE-2017-2313

Affected Products

Junos

References · 6

• https://bdu.fstec.ru/vul/2017-01133 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-2313 · Security Note
• https://kb.juniper.net/JSA10778 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2313 · Vendor Advisory
• http://securityfocus.com/bid/97606 · Note
• http://securitytracker.com/id/1038257 · Note