PT-2017-1974 · Juniper Networks · Junos

Published 2017-04-24 · Updated 2019-10-03 · CVE-2017-2312

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Junos OS versions 13.3 prior to 13.3R10 Junos OS versions 14.1 prior to 14.1R8 Junos OS versions 14.2 prior to 14.2R7-S6 or 14.2R8 Junos OS versions 15.1 prior to 15.1F2-S14, 15.1F6-S4, 15.1F7, 15.1R4-S7, 15.1R5 Junos OS versions 15.1X49 before 15.1X49-D70 Junos OS versions 15.1X53 before 15.1X53-D230, 15.1X53-D63, 15.1X53-D70 Junos OS versions 16.1 before 16.1R2

Description The issue is related to the management of resources in the Junos OS, specifically with LDP (Label Distribution Protocol) enabled. Repeatedly receiving specific LDP packets can cause the memory allocated for the rpd (routing protocol daemon) process to exhaust, leading to a crash and restart of the process. This affects devices with either IPv4 or IPv6 LDP enabled via the protocols ldp configuration. The interface on which the packet arrives needs to have LDP enabled.

Recommendations For Junos OS versions 13.3 prior to 13.3R10, update to 13.3R10 or later. For Junos OS versions 14.1 prior to 14.1R8, update to 14.1R8 or later. For Junos OS versions 14.2 prior to 14.2R7-S6 or 14.2R8, update to 14.2R7-S6, 14.2R8, or later. For Junos OS versions 15.1 prior to 15.1F2-S14, 15.1F6-S4, 15.1F7, 15.1R4-S7, 15.1R5, update to 15.1F2-S14, 15.1F6-S4, 15.1F7, 15.1R4-S7, 15.1R5, or later. For Junos OS versions 15.1X49 before 15.1X49-D70, update to 15.1X49-D70 or later. For Junos OS versions 15.1X53 before 15.1X53-D230, 15.1X53-D63, 15.1X53-D70, update to 15.1X53-D230, 15.1X53-D63, 15.1X53-D70, or later. For Junos OS versions 16.1 before 16.1R2, update to 16.1R2 or later. As a temporary workaround, consider disabling LDP on interfaces where it is not necessary until a patch is available.

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

CWE-399

Related Identifiers

BDU:2017-01134

CVE-2017-2312

Affected Products

Junos

References · 6

• https://bdu.fstec.ru/vul/2017-01134 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-2312 · Security Note
• https://osv.dev/vulnerability/CVE-2017-2312 · Vendor Advisory
• https://kb.juniper.net/JSA10777 · Vendor Advisory
• http://securitytracker.com/id/1038252 · Note
• http://securityfocus.com/bid/97611 · Note