PT-2018-8575 · Juniper Networks · Junos

Published 2018-07-11 · Updated 2019-10-09 · CVE-2018-0027

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 16.1R3

Description: The issue is caused by the receipt of a crafted or malformed RSVP PATH message, which may cause the routing protocol daemon (RPD) to hang or crash. This can lead to an extended network outage because routing updates cannot be processed when RPD is unavailable. The issue can only be triggered on interfaces where RSVP is enabled.

Recommendations: For Junos OS versions prior to 16.1R3, update to version 16.1R3 or later to resolve the issue. As a temporary workaround, consider disabling RSVP on interfaces where it is not necessary to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-0027

Affected Products

Junos

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-0027 · Security Note
• https://kb.juniper.net/JSA10861 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0027 · Vendor Advisory
• http://securityfocus.com/bid/104721 · Note
• http://securitytracker.com/id/1041318 · Note