Vulnerability-Lookup

BDU:2021-04507 (CVE-2021-0285)

Vulnerability from fstec – Published: 2021-09-15 – Updated: 2021-09-15 – View on bdu.fstec.ru Fixed

Title

Уязвимость операционных систем Juniper Networks Junos OS маршрутизаторов серий QFX5000 и EX4600, связанная с неограниченным распределением ресурсов, позволяющая нарушителю вызвать отказ в обслуживании

Summary

Уязвимость операционных систем Juniper Networks Junos OS маршрутизаторов серий QFX5000 и EX4600 связана с неограниченным распределением ресурсов. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании

Severity

7.8 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:N/I:N/A:C

7.5 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Resource manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-770 - Неограниченное распределение ресурсов или дросселирование

Aliases

CVE-2021-0285, JSA, ID:11187

References

2 references

URL
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11187
https://nvd.nist.gov/vuln/detail/CVE-2021-0285

Impacted products

1 product from 1 vendor

Vendors

Juniper Networks Inc.

Products

JunOS

Versions

от 15.1 до 15.1R7-S9 (JunOS), от 17.3 до 17.3R3-S11 (JunOS), от 17.4 до 17.4R2-S13 (JunOS), 17.4R3-S5 (JunOS), от 18.3 до 18.3R3-S5 (JunOS), от 18.4 до 18.4R2-S8 (JunOS), 18.4R3-S7 (JunOS), от 19.1 до 19.1R3-S5 (JunOS), от 19.2 до 19.2R1-S6 (JunOS), 19.2R3-S2 (JunOS), от 19.3 до 19.3R2-S6 (JunOS), 19.3R3-S2 (JunOS), от 19.4 до 19.4R1-S4 (JunOS), 19.4R2-S4, 19.4R3-S2 (JunOS), от 20.1 до 20.1R2-S2 (JunOS), 20.1R3 (JunOS), от 20.2 до 20.2R2-S3 (JunOS), 20.2R3 (JunOS), от 20.3 до 20.3R2 (JunOS), от 20.4 до 20.4R1-S1 (JunOS), 20.4R2 (JunOS)

Product types

Operating system

Platforms

Juniper Networks Inc. JunOS от 15.1 до 15.1R7-S9 EX4600, Juniper Networks Inc. JunOS от 15.1 до 15.1R7-S9 QFX5000, Juniper Networks Inc. JunOS от 17.3 до 17.3R3-S11 EX4600, Juniper Networks Inc. JunOS от 17.3 до 17.3R3-S11 QFX5000, Juniper Networks Inc. JunOS от 17.4 до 17.4R2-S13 EX4600, Juniper Networks Inc. JunOS от 17.4 до 17.4R2-S13 QFX5000, Juniper Networks Inc. JunOS 17.4R3-S5 EX4600, Juniper Networks Inc. JunOS 17.4R3-S5 QFX5000, Juniper Networks Inc. JunOS от 18.3 до 18.3R3-S5 EX4600, Juniper Networks Inc. JunOS от 18.3 до 18.3R3-S5 QFX5000, Juniper Networks Inc. JunOS от 18.4 до 18.4R2-S8 EX4600, Juniper Networks Inc. JunOS от 18.4 до 18.4R2-S8 QFX5000, Juniper Networks Inc. JunOS 18.4R3-S7 EX4600, Juniper Networks Inc. JunOS 18.4R3-S7 QFX5000, Juniper Networks Inc. JunOS от 19.1 до 19.1R3-S5 EX4600, Juniper Networks Inc. JunOS от 19.1 до 19.1R3-S5 QFX5000, Juniper Networks Inc. JunOS от 19.2 до 19.2R1-S6 EX4600, Juniper Networks Inc. JunOS от 19.2 до 19.2R1-S6 QFX5000, Juniper Networks Inc. JunOS 19.2R3-S2 EX4600, Juniper Networks Inc. JunOS 19.2R3-S2 QFX5000, Juniper Networks Inc. JunOS от 19.3 до 19.3R2-S6 EX4600, Juniper Networks Inc. JunOS от 19.3 до 19.3R2-S6 QFX5000, Juniper Networks Inc. JunOS 19.3R3-S2 EX4600, Juniper Networks Inc. JunOS 19.3R3-S2 QFX5000, Juniper Networks Inc. JunOS от 19.4 до 19.4R1-S4 EX4600, Juniper Networks Inc. JunOS от 19.4 до 19.4R1-S4 QFX5000, Juniper Networks Inc. JunOS 19.4R2-S4, 19.4R3-S2 EX4600, 19.4R3-S2 QFX5000, Juniper Networks Inc. JunOS от 20.1 до 20.1R2-S2 EX4600, Juniper Networks Inc. JunOS от 20.1 до 20.1R2-S2 QFX5000, Juniper Networks Inc. JunOS 20.1R3 EX4600, Juniper Networks Inc. JunOS 20.1R3 QFX5000, Juniper Networks Inc. JunOS от 20.2 до 20.2R2-S3 EX4600, Juniper Networks Inc. JunOS от 20.2 до 20.2R2-S3 QFX5000, Juniper Networks Inc. JunOS 20.2R3 EX4600, Juniper Networks Inc. JunOS 20.2R3 QFX5000, Juniper Networks Inc. JunOS от 20.3 до 20.3R2 EX4600, Juniper Networks Inc. JunOS от 20.3 до 20.3R2 QFX5000, Juniper Networks Inc. JunOS от 20.4 до 20.4R1-S1 EX4600, Juniper Networks Inc. JunOS от 20.4 до 20.4R1-S1 QFX5000, Juniper Networks Inc. JunOS 20.4R2 EX4600, Juniper Networks Inc. JunOS 20.4R2 QFX5000

Mitigations

Использование рекомендаций: https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11187

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Juniper Networks Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u043e\u0442 15.1 \u0434\u043e 15.1R7-S9 (JunOS), \u043e\u0442 17.3 \u0434\u043e 17.3R3-S11 (JunOS), \u043e\u0442 17.4 \u0434\u043e 17.4R2-S13 (JunOS), 17.4R3-S5 (JunOS), \u043e\u0442 18.3 \u0434\u043e 18.3R3-S5 (JunOS), \u043e\u0442 18.4 \u0434\u043e 18.4R2-S8 (JunOS), 18.4R3-S7 (JunOS), \u043e\u0442 19.1 \u0434\u043e 19.1R3-S5 (JunOS), \u043e\u0442 19.2 \u0434\u043e 19.2R1-S6 (JunOS), 19.2R3-S2 (JunOS), \u043e\u0442 19.3 \u0434\u043e 19.3R2-S6 (JunOS), 19.3R3-S2 (JunOS), \u043e\u0442 19.4 \u0434\u043e 19.4R1-S4 (JunOS), 19.4R2-S4, 19.4R3-S2 (JunOS), \u043e\u0442 20.1 \u0434\u043e 20.1R2-S2 (JunOS), 20.1R3 (JunOS), \u043e\u0442 20.2 \u0434\u043e 20.2R2-S3 (JunOS), 20.2R3 (JunOS), \u043e\u0442 20.3 \u0434\u043e 20.3R2 (JunOS), \u043e\u0442 20.4 \u0434\u043e 20.4R1-S1 (JunOS), 20.4R2 (JunOS)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11187",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "14.07.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "15.09.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "15.09.2021",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2021-04507",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2021-0285, JSA ID:11187",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "JunOS",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Juniper Networks Inc. JunOS \u043e\u0442 15.1 \u0434\u043e 15.1R7-S9 EX4600, Juniper Networks Inc. JunOS \u043e\u0442 15.1 \u0434\u043e 15.1R7-S9 QFX5000, Juniper Networks Inc. JunOS \u043e\u0442 17.3 \u0434\u043e 17.3R3-S11 EX4600, Juniper Networks Inc. JunOS \u043e\u0442 17.3 \u0434\u043e 17.3R3-S11 QFX5000, Juniper Networks Inc. JunOS \u043e\u0442 17.4 \u0434\u043e 17.4R2-S13 EX4600, Juniper Networks Inc. JunOS \u043e\u0442 17.4 \u0434\u043e 17.4R2-S13 QFX5000, Juniper Networks Inc. JunOS 17.4R3-S5 EX4600, Juniper Networks Inc. JunOS 17.4R3-S5 QFX5000, Juniper Networks Inc. JunOS \u043e\u0442 18.3 \u0434\u043e 18.3R3-S5 EX4600, Juniper Networks Inc. JunOS \u043e\u0442 18.3 \u0434\u043e 18.3R3-S5 QFX5000, Juniper Networks Inc. JunOS \u043e\u0442 18.4 \u0434\u043e 18.4R2-S8 EX4600, Juniper Networks Inc. JunOS \u043e\u0442 18.4 \u0434\u043e 18.4R2-S8 QFX5000, Juniper Networks Inc. JunOS 18.4R3-S7 EX4600, Juniper Networks Inc. JunOS 18.4R3-S7 QFX5000, Juniper Networks Inc. JunOS \u043e\u0442 19.1 \u0434\u043e 19.1R3-S5 EX4600, Juniper Networks Inc. JunOS \u043e\u0442 19.1 \u0434\u043e 19.1R3-S5 QFX5000, Juniper Networks Inc. JunOS \u043e\u0442 19.2 \u0434\u043e 19.2R1-S6 EX4600, Juniper Networks Inc. JunOS \u043e\u0442 19.2 \u0434\u043e 19.2R1-S6 QFX5000, Juniper Networks Inc. JunOS 19.2R3-S2 EX4600, Juniper Networks Inc. JunOS 19.2R3-S2 QFX5000, Juniper Networks Inc. JunOS \u043e\u0442 19.3 \u0434\u043e 19.3R2-S6 EX4600, Juniper Networks Inc. JunOS \u043e\u0442 19.3 \u0434\u043e 19.3R2-S6 QFX5000, Juniper Networks Inc. JunOS 19.3R3-S2 EX4600, Juniper Networks Inc. JunOS 19.3R3-S2 QFX5000, Juniper Networks Inc. JunOS \u043e\u0442 19.4 \u0434\u043e 19.4R1-S4 EX4600, Juniper Networks Inc. JunOS \u043e\u0442 19.4 \u0434\u043e 19.4R1-S4 QFX5000, Juniper Networks Inc. JunOS 19.4R2-S4, 19.4R3-S2 EX4600, Juniper Networks Inc. JunOS 19.4R2-S4, 19.4R3-S2 QFX5000, Juniper Networks Inc. JunOS \u043e\u0442 20.1 \u0434\u043e 20.1R2-S2 EX4600, Juniper Networks Inc. JunOS \u043e\u0442 20.1 \u0434\u043e 20.1R2-S2 QFX5000, Juniper Networks Inc. JunOS 20.1R3 EX4600, Juniper Networks Inc. JunOS 20.1R3 QFX5000, Juniper Networks Inc. JunOS \u043e\u0442 20.2 \u0434\u043e 20.2R2-S3 EX4600, Juniper Networks Inc. JunOS \u043e\u0442 20.2 \u0434\u043e 20.2R2-S3 QFX5000, Juniper Networks Inc. JunOS 20.2R3 EX4600, Juniper Networks Inc. JunOS 20.2R3 QFX5000, Juniper Networks Inc. JunOS \u043e\u0442 20.3 \u0434\u043e 20.3R2 EX4600, Juniper Networks Inc. JunOS \u043e\u0442 20.3 \u0434\u043e 20.3R2 QFX5000, Juniper Networks Inc. JunOS \u043e\u0442 20.4 \u0434\u043e 20.4R1-S1 EX4600, Juniper Networks Inc. JunOS \u043e\u0442 20.4 \u0434\u043e 20.4R1-S1 QFX5000, Juniper Networks Inc. JunOS 20.4R2 EX4600, Juniper Networks Inc. JunOS 20.4R2 QFX5000",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c Juniper Networks Junos OS \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432 \u0441\u0435\u0440\u0438\u0439 QFX5000 \u0438 EX4600, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u043c \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0438\u043b\u0438 \u0434\u0440\u043e\u0441\u0441\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 (CWE-770)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c Juniper Networks Junos OS \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432 \u0441\u0435\u0440\u0438\u0439 QFX5000 \u0438 EX4600 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u043c \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11187\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-0285",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-770",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}

CVE-2021-0285 (GCVE-0-2021-0285)

Vulnerability from cvelistv5 – Published: 2021-07-15 20:00 – Updated: 2024-09-16 16:33

Title

Junos OS: QFX5000 Series and EX4600 Series: Continuous traffic destined to a device configured with MC-LAG leading to nodes losing their control connection which can impact traffic

Summary

An uncontrolled resource consumption vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series switches allows an attacker sending large amounts of legitimate traffic destined to the device to cause Interchassis Control Protocol (ICCP) interruptions, leading to an unstable control connection between the Multi-Chassis Link Aggregation Group (MC-LAG) nodes which can in turn lead to traffic loss. Continued receipt of this amount of traffic will create a sustained Denial of Service (DoS) condition. An indication that the system could be impacted by this issue is the following log message: "DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception LOCALNH:aggregate exceeded its allowed bandwidth at fpc <fpc number> for <n> times, started at <timestamp>" This issue affects Juniper Networks Junos OS on QFX5000 Series and EX4600 Series: 15.1 versions prior to 15.1R7-S9; 17.3 versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R2-S13, 17.4R3-S5; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R2-S8, 18.4R3-S7; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R1-S6, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3-S2; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R2-S3, 20.2R3; 20.3 versions prior to 20.3R2; 20.4 versions prior to 20.4R1-S1, 20.4R2.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

juniper mitre root

References

1 reference

URL	Tags
https://kb.juniper.net/JSA11187	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
Juniper Networks	Junos OS	Affected: 15.1 , < 15.1R7-S9 (custom) Affected: 17.3 , < 17.3R3-S11 (custom) Affected: 17.4 , < 17.4R2-S13, 17.4R3-S5 (custom) Affected: 18.3 , < 18.3R3-S5 (custom) Affected: 18.4 , < 18.4R2-S8, 18.4R3-S7 (custom) Affected: 19.1 , < 19.1R3-S5 (custom) Affected: 19.2 , < 19.2R1-S6, 19.2R3-S2 (custom) Affected: 19.3 , < 19.3R2-S6, 19.3R3-S2 (custom) Affected: 19.4 , < 19.4R1-S4, 19.4R2-S4, 19.4R3-S2 (custom) Affected: 20.1 , < 20.1R2-S2, 20.1R3 (custom) Affected: 20.2 , < 20.2R2-S3, 20.2R3 (custom) Affected: 20.3 , < 20.3R2 (custom) Affected: 20.4 , < 20.4R1-S1, 20.4R2 (custom)

Date Public

2021-07-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:32:10.575Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kb.juniper.net/JSA11187"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "QFX5000 Series and EX4600 Series"
          ],
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "15.1R7-S9",
              "status": "affected",
              "version": "15.1",
              "versionType": "custom"
            },
            {
              "lessThan": "17.3R3-S11",
              "status": "affected",
              "version": "17.3",
              "versionType": "custom"
            },
            {
              "lessThan": "17.4R2-S13, 17.4R3-S5",
              "status": "affected",
              "version": "17.4",
              "versionType": "custom"
            },
            {
              "lessThan": "18.3R3-S5",
              "status": "affected",
              "version": "18.3",
              "versionType": "custom"
            },
            {
              "lessThan": "18.4R2-S8, 18.4R3-S7",
              "status": "affected",
              "version": "18.4",
              "versionType": "custom"
            },
            {
              "lessThan": "19.1R3-S5",
              "status": "affected",
              "version": "19.1",
              "versionType": "custom"
            },
            {
              "lessThan": "19.2R1-S6, 19.2R3-S2",
              "status": "affected",
              "version": "19.2",
              "versionType": "custom"
            },
            {
              "lessThan": "19.3R2-S6, 19.3R3-S2",
              "status": "affected",
              "version": "19.3",
              "versionType": "custom"
            },
            {
              "lessThan": "19.4R1-S4, 19.4R2-S4, 19.4R3-S2",
              "status": "affected",
              "version": "19.4",
              "versionType": "custom"
            },
            {
              "lessThan": "20.1R2-S2, 20.1R3",
              "status": "affected",
              "version": "20.1",
              "versionType": "custom"
            },
            {
              "lessThan": "20.2R2-S3, 20.2R3",
              "status": "affected",
              "version": "20.2",
              "versionType": "custom"
            },
            {
              "lessThan": "20.3R2",
              "status": "affected",
              "version": "20.3",
              "versionType": "custom"
            },
            {
              "lessThan": "20.4R1-S1, 20.4R2",
              "status": "affected",
              "version": "20.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "This issue only affects devices with ICCP configured:\n\n[ protocols iccp peer ]"
        }
      ],
      "datePublic": "2021-07-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An uncontrolled resource consumption vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series switches allows an attacker sending large amounts of legitimate traffic destined to the device to cause Interchassis Control Protocol (ICCP) interruptions, leading to an unstable control connection between the Multi-Chassis Link Aggregation Group (MC-LAG) nodes which can in turn lead to traffic loss. Continued receipt of this amount of traffic will create a sustained Denial of Service (DoS) condition. An indication that the system could be impacted by this issue is the following log message: \"DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception LOCALNH:aggregate exceeded its allowed bandwidth at fpc \u003cfpc number\u003e for \u003cn\u003e times, started at \u003ctimestamp\u003e\" This issue affects Juniper Networks Junos OS on QFX5000 Series and EX4600 Series: 15.1 versions prior to 15.1R7-S9; 17.3 versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R2-S13, 17.4R3-S5; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R2-S8, 18.4R3-S7; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R1-S6, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3-S2; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R2-S3, 20.2R3; 20.3 versions prior to 20.3R2; 20.4 versions prior to 20.4R1-S1, 20.4R2."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-07-15T20:00:58.000Z",
        "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "shortName": "juniper"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kb.juniper.net/JSA11187"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "The following software releases have been updated to resolve this specific issue: 15.1R7-S9, 17.3R3-S11, 17.4R2-S13, 17.4R3-S5, 18.1R3-S13, 18.2R3-S8, 18.3R3-S5, 18.4R2-S8, 18.4R3-S7, 19.1R3-S5, 19.2R1-S6, 19.2R3-S2, 19.3R2-S6, 19.3R3-S2, 19.4R1-S4, 19.4R2-S4, 19.4R3-S2, 20.1R2-S2, 20.1R3, 20.2R2-S3, 20.2R3, 20.3R2, 20.4R1-S1, 20.4R2, 21.1R1, and all subsequent releases."
        }
      ],
      "source": {
        "advisory": "JSA11187",
        "defect": [
          "1552877"
        ],
        "discovery": "USER"
      },
      "title": "Junos OS: QFX5000 Series and EX4600 Series: Continuous traffic destined to a device configured with MC-LAG leading to nodes losing their control connection which can impact traffic",
      "workarounds": [
        {
          "lang": "en",
          "value": "While no complete workaround exists, the risk of malicious exploitation can be reduced by filtering undesirable traffic using firewall filters and policers, or increase the bandwidth for the localnh DDOS queue."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "sirt@juniper.net",
          "DATE_PUBLIC": "2021-07-14T16:00:00.000Z",
          "ID": "CVE-2021-0285",
          "STATE": "PUBLIC",
          "TITLE": "Junos OS: QFX5000 Series and EX4600 Series: Continuous traffic destined to a device configured with MC-LAG leading to nodes losing their control connection which can impact traffic"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Junos OS",
                      "version": {
                        "version_data": [
                          {
                            "platform": "QFX5000 Series and EX4600 Series",
                            "version_affected": "\u003c",
                            "version_name": "15.1",
                            "version_value": "15.1R7-S9"
                          },
                          {
                            "platform": "QFX5000 Series and EX4600 Series",
                            "version_affected": "\u003c",
                            "version_name": "17.3",
                            "version_value": "17.3R3-S11"
                          },
                          {
                            "platform": "QFX5000 Series and EX4600 Series",
                            "version_affected": "\u003c",
                            "version_name": "17.4",
                            "version_value": "17.4R2-S13, 17.4R3-S5"
                          },
                          {
                            "platform": "QFX5000 Series and EX4600 Series",
                            "version_affected": "\u003c",
                            "version_name": "18.3",
                            "version_value": "18.3R3-S5"
                          },
                          {
                            "platform": "QFX5000 Series and EX4600 Series",
                            "version_affected": "\u003c",
                            "version_name": "18.4",
                            "version_value": "18.4R2-S8, 18.4R3-S7"
                          },
                          {
                            "platform": "QFX5000 Series and EX4600 Series",
                            "version_affected": "\u003c",
                            "version_name": "19.1",
                            "version_value": "19.1R3-S5"
                          },
                          {
                            "platform": "QFX5000 Series and EX4600 Series",
                            "version_affected": "\u003c",
                            "version_name": "19.2",
                            "version_value": "19.2R1-S6, 19.2R3-S2"
                          },
                          {
                            "platform": "QFX5000 Series and EX4600 Series",
                            "version_affected": "\u003c",
                            "version_name": "19.3",
                            "version_value": "19.3R2-S6, 19.3R3-S2"
                          },
                          {
                            "platform": "QFX5000 Series and EX4600 Series",
                            "version_affected": "\u003c",
                            "version_name": "19.4",
                            "version_value": "19.4R1-S4, 19.4R2-S4, 19.4R3-S2"
                          },
                          {
                            "platform": "QFX5000 Series and EX4600 Series",
                            "version_affected": "\u003c",
                            "version_name": "20.1",
                            "version_value": "20.1R2-S2, 20.1R3"
                          },
                          {
                            "platform": "QFX5000 Series and EX4600 Series",
                            "version_affected": "\u003c",
                            "version_name": "20.2",
                            "version_value": "20.2R2-S3, 20.2R3"
                          },
                          {
                            "platform": "QFX5000 Series and EX4600 Series",
                            "version_affected": "\u003c",
                            "version_name": "20.3",
                            "version_value": "20.3R2"
                          },
                          {
                            "platform": "QFX5000 Series and EX4600 Series",
                            "version_affected": "\u003c",
                            "version_name": "20.4",
                            "version_value": "20.4R1-S1, 20.4R2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Juniper Networks"
              }
            ]
          }
        },
        "configuration": [
          {
            "lang": "en",
            "value": "This issue only affects devices with ICCP configured:\n\n[ protocols iccp peer ]"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An uncontrolled resource consumption vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series switches allows an attacker sending large amounts of legitimate traffic destined to the device to cause Interchassis Control Protocol (ICCP) interruptions, leading to an unstable control connection between the Multi-Chassis Link Aggregation Group (MC-LAG) nodes which can in turn lead to traffic loss. Continued receipt of this amount of traffic will create a sustained Denial of Service (DoS) condition. An indication that the system could be impacted by this issue is the following log message: \"DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception LOCALNH:aggregate exceeded its allowed bandwidth at fpc \u003cfpc number\u003e for \u003cn\u003e times, started at \u003ctimestamp\u003e\" This issue affects Juniper Networks Junos OS on QFX5000 Series and EX4600 Series: 15.1 versions prior to 15.1R7-S9; 17.3 versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R2-S13, 17.4R3-S5; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R2-S8, 18.4R3-S7; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R1-S6, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3-S2; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R2-S3, 20.2R3; 20.3 versions prior to 20.3R2; 20.4 versions prior to 20.4R1-S1, 20.4R2."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
          }
        ],
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-770 Allocation of Resources Without Limits or Throttling"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://kb.juniper.net/JSA11187",
              "refsource": "CONFIRM",
              "url": "https://kb.juniper.net/JSA11187"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "The following software releases have been updated to resolve this specific issue: 15.1R7-S9, 17.3R3-S11, 17.4R2-S13, 17.4R3-S5, 18.1R3-S13, 18.2R3-S8, 18.3R3-S5, 18.4R2-S8, 18.4R3-S7, 19.1R3-S5, 19.2R1-S6, 19.2R3-S2, 19.3R2-S6, 19.3R3-S2, 19.4R1-S4, 19.4R2-S4, 19.4R3-S2, 20.1R2-S2, 20.1R3, 20.2R2-S3, 20.2R3, 20.3R2, 20.4R1-S1, 20.4R2, 21.1R1, and all subsequent releases."
          }
        ],
        "source": {
          "advisory": "JSA11187",
          "defect": [
            "1552877"
          ],
          "discovery": "USER"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "While no complete workaround exists, the risk of malicious exploitation can be reduced by filtering undesirable traffic using firewall filters and policers, or increase the bandwidth for the localnh DDOS queue."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
    "assignerShortName": "juniper",
    "cveId": "CVE-2021-0285",
    "datePublished": "2021-07-15T20:00:58.517Z",
    "dateReserved": "2020-10-27T00:00:00.000Z",
    "dateUpdated": "2024-09-16T16:33:37.636Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.