Vulnerability-Lookup

CNVD-2017-31445

Vulnerability from cnvd - Published: 2017-10-25

Title

Juniper Junos OS拒绝服务漏洞

Description

Juniper Junos OS是美国瞻博网络（Juniper Networks）公司的一套专用于该公司的硬件系统的网络操作系统。该操作系统提供了安全编程接口和Junos SDK。 Juniper Networks Junos OS中存在安全漏洞。攻击者可借助特制的传递属性利用该漏洞造成拒绝服务（RPD路由进程崩溃）。

Severity

中

Patch Name

Juniper Junos OS拒绝服务漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://kb.juniper.net/InfoCenter/index?page=content&id;=JSA10820&actp;=METADATA

Reference

https://kb.juniper.net/JSA10820

Impacted products

Name
['Juniper Networks Junos OS 15.1', 'Juniper Networks Junos OS 16.1', 'Juniper Networks Junos OS 14.1X53', 'Juniper Networks Junos OS 15.1X49', 'Juniper Networks Junos OS 13.3', 'Juniper Networks Junos OS 14.1', 'Juniper Networks Junos OS 14.1X50', 'Juniper Networks Junos OS 14.2', 'Juniper Networks Junos OS 15.1X53', 'Juniper Networks Junos OS 16.2', 'Juniper Networks Junos OS 17.1', 'Juniper Networks Junos OS 17.2', 'Juniper Networks Junos OS 17.2X75']

Name

['Juniper Networks Junos OS 15.1', 'Juniper Networks Junos OS 16.1', 'Juniper Networks Junos OS 14.1X53', 'Juniper Networks Junos OS 15.1X49', 'Juniper Networks Junos OS 13.3', 'Juniper Networks Junos OS 14.1', 'Juniper Networks Junos OS 14.1X50', 'Juniper Networks Junos OS 14.2', 'Juniper Networks Junos OS 15.1X53', 'Juniper Networks Junos OS 16.2', 'Juniper Networks Junos OS 17.1', 'Juniper Networks Junos OS 17.2', 'Juniper Networks Junos OS 17.2X75']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-10618"
    }
  },
  "description": "Juniper Junos OS\u662f\u7f8e\u56fd\u77bb\u535a\u7f51\u7edc\uff08Juniper Networks\uff09\u516c\u53f8\u7684\u4e00\u5957\u4e13\u7528\u4e8e\u8be5\u516c\u53f8\u7684\u786c\u4ef6\u7cfb\u7edf\u7684\u7f51\u7edc\u64cd\u4f5c\u7cfb\u7edf\u3002\u8be5\u64cd\u4f5c\u7cfb\u7edf\u63d0\u4f9b\u4e86\u5b89\u5168\u7f16\u7a0b\u63a5\u53e3\u548cJunos SDK\u3002\r\n\r\nJuniper Networks Junos OS\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684\u4f20\u9012\u5c5e\u6027\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff08RPD\u8def\u7531\u8fdb\u7a0b\u5d29\u6e83\uff09\u3002",
  "discovererName": "Juniper Networks",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://kb.juniper.net/InfoCenter/index?page=content\u0026id;=JSA10820\u0026actp;=METADATA",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-31445",
  "openTime": "2017-10-25",
  "patchDescription": "Juniper Junos OS\u662f\u7f8e\u56fd\u77bb\u535a\u7f51\u7edc\uff08Juniper Networks\uff09\u516c\u53f8\u7684\u4e00\u5957\u4e13\u7528\u4e8e\u8be5\u516c\u53f8\u7684\u786c\u4ef6\u7cfb\u7edf\u7684\u7f51\u7edc\u64cd\u4f5c\u7cfb\u7edf\u3002\u8be5\u64cd\u4f5c\u7cfb\u7edf\u63d0\u4f9b\u4e86\u5b89\u5168\u7f16\u7a0b\u63a5\u53e3\u548cJunos SDK\u3002\r\n\r\nJuniper Networks Junos OS\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684\u4f20\u9012\u5c5e\u6027\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff08RPD\u8def\u7531\u8fdb\u7a0b\u5d29\u6e83\uff09\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Juniper Junos OS\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Juniper Networks Junos OS 15.1",
      "Juniper Networks Junos OS 16.1",
      "Juniper Networks Junos OS 14.1X53",
      "Juniper Networks Junos OS 15.1X49",
      "Juniper Networks Junos OS 13.3",
      "Juniper Networks Junos OS 14.1",
      "Juniper Networks Junos OS 14.1X50",
      "Juniper Networks Junos OS 14.2",
      "Juniper Networks Junos OS 15.1X53",
      "Juniper Networks Junos OS 16.2",
      "Juniper Networks Junos OS 17.1",
      "Juniper Networks Junos OS 17.2",
      "Juniper Networks Junos OS 17.2X75"
    ]
  },
  "referenceLink": "https://kb.juniper.net/JSA10820",
  "serverity": "\u4e2d",
  "submitTime": "2017-10-19",
  "title": "Juniper Junos OS\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2017-10618 (GCVE-0-2017-10618)

Vulnerability from cvelistv5 – Published: 2017-10-13 17:00 – Updated: 2024-09-17 04:04

Title

Junos: RPD core due to BGP UPDATE with malformed optional transitive attributes

Summary

When the 'bgp-error-tolerance' feature â" designed to help mitigate remote session resets from malformed path attributes â" is enabled, a BGP UPDATE containing a specifically crafted set of transitive attributes can cause the RPD routing process to crash and restart. Devices with BGP enabled that do not have 'bgp-error-tolerance' configured are not vulnerable to this issue. Affected releases are Juniper Networks Junos OS 13.3 prior to 13.3R10-S2; 14.1 prior to 14.1R8-S4, 14.1R9; 14.1X50 prior to 14.1X50-D185; 14.1X53 prior to 14.1X53-D45, 14.1X53-D50; 14.2 prior to 14.2R7-S7, 14.2R8; 15.1 prior to 15.1F5-S8, 15.1F6-S7, 15.1R5-S6, 15.1R6-S2, 15.1R7; 15.1X49 prior to 15.1X49-D100; 15.1X53 prior to 15.1X53-D64, 15.1X53-D70; 16.1 prior to 16.1R3-S4, 16.1R4-S3, 16.1R5; 16.2 prior to 16.2R1-S5, 16.2R2; 17.1 prior to 17.1R1-S3, 17.1R2; 17.2 prior to 17.2R1-S2, 17.2R2; 17.2X75 prior to 17.2X75-D50. No other Juniper Networks products or platforms are affected by this issue.

Severity ?

5.9 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

Denial of service

Assigner

juniper

References

URL

Tags

	https://www.juniper.net/documentation/en_US/junos…	x_refsource_MISC
	https://kb.juniper.net/JSA10820	x_refsource_CONFIRM
	https://www.juniper.net/documentation/en_US/junos…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Juniper Networks	Junos OS	Affected: 13.3 prior to 13.3R10-S2 Affected: 14.1 prior to 14.1R8-S4, 14.1R9 Affected: 14.1X50 prior to 14.1X50-D185 Affected: 14.1X53 prior to 14.1X53-D45, 14.1X53-D50 Affected: 14.2 prior to 14.2R7-S7, 14.2R8 Affected: 15.1 prior to 15.1F5-S8, 15.1F6-S7, 15.1R5-S6, 15.1R6-S2, 15.1R7 Affected: 15.1X49 prior to 15.1X49-D100 Affected: 15.1X53 prior to 15.1X53-D64, 15.1X53-D70 Affected: 16.1 prior to 16.1R3-S4, 16.1R4-S3, 16.1R5 Affected: 16.2 prior to 16.2R1-S5, 16.2R2 Affected: 17.1 prior to 17.1R1-S3, 17.1R2 Affected: 17.2 prior to 17.2R1-S2, 17.2R2 Affected: 17.2X75 prior to 17.2X75-D50

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T17:41:55.489Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.juniper.net/documentation/en_US/junos/topics/concept/bgp-error-handling-overview.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kb.juniper.net/JSA10820"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/bgp-error-tolerance.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "status": "affected",
              "version": "13.3 prior to 13.3R10-S2"
            },
            {
              "status": "affected",
              "version": "14.1 prior to 14.1R8-S4, 14.1R9"
            },
            {
              "status": "affected",
              "version": "14.1X50 prior to 14.1X50-D185"
            },
            {
              "status": "affected",
              "version": "14.1X53 prior to 14.1X53-D45, 14.1X53-D50"
            },
            {
              "status": "affected",
              "version": "14.2 prior to 14.2R7-S7, 14.2R8"
            },
            {
              "status": "affected",
              "version": "15.1 prior to 15.1F5-S8, 15.1F6-S7, 15.1R5-S6, 15.1R6-S2, 15.1R7"
            },
            {
              "status": "affected",
              "version": "15.1X49 prior to 15.1X49-D100"
            },
            {
              "status": "affected",
              "version": "15.1X53 prior to 15.1X53-D64, 15.1X53-D70"
            },
            {
              "status": "affected",
              "version": "16.1 prior to 16.1R3-S4, 16.1R4-S3, 16.1R5"
            },
            {
              "status": "affected",
              "version": "16.2 prior to 16.2R1-S5, 16.2R2"
            },
            {
              "status": "affected",
              "version": "17.1 prior to 17.1R1-S3, 17.1R2"
            },
            {
              "status": "affected",
              "version": "17.2 prior to 17.2R1-S2, 17.2R2"
            },
            {
              "status": "affected",
              "version": "17.2X75 prior to 17.2X75-D50"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "This only affects devices with \u0027bgp-error-tolerance\u0027 feature enabled."
        }
      ],
      "datePublic": "2017-10-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "When the \u0027bgp-error-tolerance\u0027 feature \u0026#xe2;\u0026#x80;\" designed to help mitigate remote session resets from malformed path attributes \u0026#xe2;\u0026#x80;\" is enabled, a BGP UPDATE containing a specifically crafted set of transitive attributes can cause the RPD routing process to crash and restart. Devices with BGP enabled that do not have \u0027bgp-error-tolerance\u0027 configured are not vulnerable to this issue. Affected releases are Juniper Networks Junos OS 13.3 prior to 13.3R10-S2; 14.1 prior to 14.1R8-S4, 14.1R9; 14.1X50 prior to 14.1X50-D185; 14.1X53 prior to 14.1X53-D45, 14.1X53-D50; 14.2 prior to 14.2R7-S7, 14.2R8; 15.1 prior to 15.1F5-S8, 15.1F6-S7, 15.1R5-S6, 15.1R6-S2, 15.1R7; 15.1X49 prior to 15.1X49-D100; 15.1X53 prior to 15.1X53-D64, 15.1X53-D70; 16.1 prior to 16.1R3-S4, 16.1R4-S3, 16.1R5; 16.2 prior to 16.2R1-S5, 16.2R2; 17.1 prior to 17.1R1-S3, 17.1R2; 17.2 prior to 17.2R1-S2, 17.2R2; 17.2X75 prior to 17.2X75-D50. No other Juniper Networks products or platforms are affected by this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-13T16:57:01",
        "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "shortName": "juniper"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.juniper.net/documentation/en_US/junos/topics/concept/bgp-error-handling-overview.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kb.juniper.net/JSA10820"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/bgp-error-tolerance.html"
        }
      ],
      "title": "Junos: RPD core due to BGP UPDATE with malformed optional transitive attributes",
      "workarounds": [
        {
          "lang": "en",
          "value": "If \u0027bgp-error-tolerance\u0027 is enabled, disabling this option under \u0027protocols bgp\u0027 will mitigate this issue.\n\nNote that when the error handling feature is off, the router is vulnerable to session resets from malformed path attributes.  However, this is RFC 4271 compliant behavior."
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "sirt@juniper.net",
          "DATE_PUBLIC": "2017-10-11T09:00",
          "ID": "CVE-2017-10618",
          "STATE": "PUBLIC",
          "TITLE": "Junos: RPD core due to BGP UPDATE with malformed optional transitive attributes"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Junos OS",
                      "version": {
                        "version_data": [
                          {
                            "platform": "",
                            "version_value": "13.3 prior to 13.3R10-S2"
                          },
                          {
                            "platform": "",
                            "version_value": "14.1 prior to 14.1R8-S4, 14.1R9"
                          },
                          {
                            "platform": "",
                            "version_value": "14.1X50 prior to 14.1X50-D185"
                          },
                          {
                            "platform": "",
                            "version_value": "14.1X53 prior to 14.1X53-D45, 14.1X53-D50"
                          },
                          {
                            "platform": "",
                            "version_value": "14.2 prior to 14.2R7-S7, 14.2R8"
                          },
                          {
                            "platform": "",
                            "version_value": "15.1 prior to 15.1F5-S8, 15.1F6-S7, 15.1R5-S6, 15.1R6-S2, 15.1R7"
                          },
                          {
                            "platform": "",
                            "version_value": "15.1X49 prior to 15.1X49-D100"
                          },
                          {
                            "platform": "",
                            "version_value": "15.1X53 prior to 15.1X53-D64, 15.1X53-D70"
                          },
                          {
                            "platform": "",
                            "version_value": "16.1 prior to 16.1R3-S4, 16.1R4-S3, 16.1R5"
                          },
                          {
                            "platform": "",
                            "version_value": "16.2 prior to 16.2R1-S5, 16.2R2"
                          },
                          {
                            "platform": "",
                            "version_value": "17.1 prior to 17.1R1-S3, 17.1R2"
                          },
                          {
                            "platform": "",
                            "version_value": "17.2 prior to 17.2R1-S2, 17.2R2"
                          },
                          {
                            "platform": "",
                            "version_value": "17.2X75 prior to 17.2X75-D50"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Juniper Networks"
              }
            ]
          }
        },
        "configuration": [
          {
            "lang": "en",
            "value": "This only affects devices with \u0027bgp-error-tolerance\u0027 feature enabled."
          }
        ],
        "credit": [],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "When the \u0027bgp-error-tolerance\u0027 feature \u0026#xe2;\u0026#x80;\" designed to help mitigate remote session resets from malformed path attributes \u0026#xe2;\u0026#x80;\" is enabled, a BGP UPDATE containing a specifically crafted set of transitive attributes can cause the RPD routing process to crash and restart. Devices with BGP enabled that do not have \u0027bgp-error-tolerance\u0027 configured are not vulnerable to this issue. Affected releases are Juniper Networks Junos OS 13.3 prior to 13.3R10-S2; 14.1 prior to 14.1R8-S4, 14.1R9; 14.1X50 prior to 14.1X50-D185; 14.1X53 prior to 14.1X53-D45, 14.1X53-D50; 14.2 prior to 14.2R7-S7, 14.2R8; 15.1 prior to 15.1F5-S8, 15.1F6-S7, 15.1R5-S6, 15.1R6-S2, 15.1R7; 15.1X49 prior to 15.1X49-D100; 15.1X53 prior to 15.1X53-D64, 15.1X53-D70; 16.1 prior to 16.1R3-S4, 16.1R4-S3, 16.1R5; 16.2 prior to 16.2R1-S5, 16.2R2; 17.1 prior to 17.1R1-S3, 17.1R2; 17.2 prior to 17.2R1-S2, 17.2R2; 17.2X75 prior to 17.2X75-D50. No other Juniper Networks products or platforms are affected by this issue."
            }
          ]
        },
        "exploit": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability, however, the issue has been seen in a production network.",
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.juniper.net/documentation/en_US/junos/topics/concept/bgp-error-handling-overview.html",
              "refsource": "MISC",
              "url": "https://www.juniper.net/documentation/en_US/junos/topics/concept/bgp-error-handling-overview.html"
            },
            {
              "name": "https://kb.juniper.net/JSA10820",
              "refsource": "CONFIRM",
              "url": "https://kb.juniper.net/JSA10820"
            },
            {
              "name": "https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/bgp-error-tolerance.html",
              "refsource": "MISC",
              "url": "https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/bgp-error-tolerance.html"
            }
          ]
        },
        "solution": "The following software releases have been updated to resolve this specific issue: 13.3R10-S2, 14.1R8-S4, 14.1R9, 14.1X50-D185, 14.1X53-D45, 14.1X53-D50, 14.2R7-S7, 14.2R8, 15.1F5-S8, 15.1F6-S7, 15.1R5-S6, 15.1R6-S2, 15.1R7, 15.1X49-D100, 15.1X53-D64, 15.1X53-D70, 16.1R3-S4, 16.1R4-S3, 16.1R5, 16.2R1-S5, 16.2R2, 17.1R1-S3, 17.1R2, 17.2R1-S2, 17.2R2, 17.2X75-D50, 17.3R1, and all subsequent releases.\n\nThis issue is being tracked as PR 1279204 and is visible on the Customer Support website.",
        "work_around": [
          {
            "lang": "en",
            "value": "If \u0027bgp-error-tolerance\u0027 is enabled, disabling this option under \u0027protocols bgp\u0027 will mitigate this issue.\n\nNote that when the error handling feature is off, the router is vulnerable to session resets from malformed path attributes.  However, this is RFC 4271 compliant behavior."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
    "assignerShortName": "juniper",
    "cveId": "CVE-2017-10618",
    "datePublished": "2017-10-13T17:00:00Z",
    "dateReserved": "2017-06-28T00:00:00",
    "dateUpdated": "2024-09-17T04:04:08.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-31445

CVE-2017-10618 (GCVE-0-2017-10618)

Tags

Sightings

Nomenclature