Details of VAR-201401-0491

ID

VAR-201401-0491

CVE

CVE-2013-7313

TITLE

Open Shortest Path First (OSPF) Protocol does not specify unique LSA lookup identifiers

Trust: 0.8

sources: CERT/CC: VU#229804

DESCRIPTION

The OSPF implementation in Juniper Junos through 13.x, JunosE, and ScreenOS through 6.3.x does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LSA) packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a crafted LSA packet, a related issue to CVE-2013-0149. The Open Shortest Path First (OSPF) protocol does not specify unique Link State Advertisement (LSA) lookup identifiers, which allow an attacker to intercept traffic or conduct a Denial of Service (DoS) attack. This vulnerability CVE-2013-0149 And related issues. Supplementary information : CWE Vulnerability type by CWE-694: Use of Multiple Resources with Duplicate Identifier ( Using multiple resources with duplicate identifiers ) Has been identified. Multiple Juniper Products are prone to a remote security-bypass vulnerability due to an error in the OSPF protocol specification. Exploiting this issue could allow an attacker to bypass certain security restrictions and take full control of the OSPF AS domain routing table, blackholed traffic, and intercepted traffic. This may aid in further attacks. Juniper Junos, JunosE and ScreenOS are all operating systems of Juniper Networks (Juniper Networks). Junos is a network operating system dedicated to the company's hardware systems; JunosE is an operating system running on E-series IP edge and broadband service routers; ScreenOS is an operating system running on NetScreen series firewalls. sex

Trust: 2.7

sources: NVD: CVE-2013-7313 // CERT/CC: VU#229804 // JVNDB: JVNDB-2013-005895 // BID: 65169 // VULHUB: VHN-67315

AFFECTED PRODUCTS

vendor:	juniper	model:	junos	scope:	eq	version:	13.3	Trust: 1.9
vendor:	juniper	model:	junos	scope:	eq	version:	13.2	Trust: 1.9
vendor:	juniper	model:	junos	scope:	eq	version:	13.1	Trust: 1.9
vendor:	juniper	model:	junos	scope:	eq	version:	12.1x46	Trust: 1.9
vendor:	juniper	model:	junos	scope:	eq	version:	12.1x45	Trust: 1.9
vendor:	juniper	model:	junos	scope:	eq	version:	12.1x44	Trust: 1.9
vendor:	juniper	model:	junos	scope:	eq	version:	12.1	Trust: 1.9
vendor:	juniper	model:	junos	scope:	eq	version:	12.3	Trust: 1.6
vendor:	juniper	model:	junos	scope:	eq	version:	12.2	Trust: 1.6
vendor:	juniper	model:	junos	scope:	eq	version:	12.1r	Trust: 1.6
vendor:	juniper	model:	junos	scope:	eq	version:	9.6	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	9.5	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	9.4	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	9.2	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	9.1	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	9.0	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	8.4	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	8.3	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	8.2	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	8.1	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	8.0	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	7.6	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	7.5	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	7.4	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	7.3	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	7.2	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	7.1	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	7.0	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	6.4	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	6.3	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	6.2	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	6.1	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	6.0	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	5.7	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	5.6	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	5.5	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	5.4	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	5.3	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	5.2	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	5.1	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	5.0	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	4.4	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	4.3	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	4.2	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	4.1	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	4.0	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	11.4x27	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	11.4	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	11.3	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	11.2	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	11.1	Trust: 1.3
vendor:	juniper	model:	junos	scope:	eq	version:	11.0	Trust: 1.3
vendor:	juniper	model:	screenos	scope:	eq	version:	6.1.0	Trust: 1.0
vendor:	juniper	model:	screenos	scope:	eq	version:	6.2.0	Trust: 1.0
vendor:	juniper	model:	screenos	scope:	eq	version:	6.0.0	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	10.0	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	10.4r	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	10.2	Trust: 1.0
vendor:	juniper	model:	screenos	scope:	lte	version:	6.3.0	Trust: 1.0
vendor:	juniper	model:	junose	scope:	eq	version:	*	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	10.3	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	10.4	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	10.4s	Trust: 1.0
vendor:	juniper	model:	screenos	scope:	eq	version:	5.4.0	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	5.0r3	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	5.0r4	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	10.1	Trust: 1.0
vendor:	brocade	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	check point	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	enterasys	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	extreme	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	juniper	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	nec	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	oracle	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	vyatta	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	yamaha	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	juniper	model:	junos os	scope:	lte	version:	13.x	Trust: 0.8
vendor:	juniper	model:	junose	scope:	-	version:	-	Trust: 0.8
vendor:	juniper	model:	screenos	scope:	lte	version:	6.3.x	Trust: 0.8
vendor:	juniper	model:	screenos	scope:	eq	version:	6.3	Trust: 0.3
vendor:	juniper	model:	screenos	scope:	eq	version:	6.2	Trust: 0.3
vendor:	juniper	model:	screenos	scope:	eq	version:	6.1	Trust: 0.3
vendor:	juniper	model:	screenos	scope:	eq	version:	6.0	Trust: 0.3
vendor:	juniper	model:	screenos	scope:	eq	version:	5.4	Trust: 0.3
vendor:	juniper	model:	junos 5.0r4	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 5.0r3	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 12.1r	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 11.4r9	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 11.4r8	scope:	-	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 11.4r10	scope:	-	version:	-	Trust: 0.3

sources: CERT/CC: VU#229804 // BID: 65169 // JVNDB: JVNDB-2013-005895 // CNNVD: CNNVD-201401-490 // NVD: CVE-2013-7313

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2013-7313
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2013-0149
value:	MEDIUM
Trust: 0.8
NVD:	CVE-2013-7313
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201401-490
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-67315
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2013-7313
severity:	MEDIUM
baseScore:	5.4
vectorString:	AV:A/AC:M/AU:N/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	5.5
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
NVD:	CVE-2013-0149
severity:	MEDIUM
baseScore:	5.4
vectorString:	NONE
accessVector:	ADJACENT NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	5.5
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
VULHUB:	VHN-67315
severity:	MEDIUM
baseScore:	5.4
vectorString:	AV:A/AC:M/AU:N/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	5.5
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: CERT/CC: VU#229804 // VULHUB: VHN-67315 // JVNDB: JVNDB-2013-005895 // CNNVD: CNNVD-201401-490 // NVD: CVE-2013-7313

PROBLEMTYPE DATA

problemtype:	NVD-CWE-Other	Trust: 1.0
problemtype:	CWE-Other	Trust: 0.8

sources: JVNDB: JVNDB-2013-005895 // NVD: CVE-2013-7313

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201401-490

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201401-490

CONFIGURATIONS

sources: JVNDB: JVNDB-2013-005895

EXPLOIT AVAILABILITY

sources: CERT/CC: VU#229804

PATCH

title:

Top Page

url:

http://www.juniper.net/

Trust: 0.8

sources: JVNDB: JVNDB-2013-005895

EXTERNAL IDS

db:	CERT/CC	id:	VU#229804	Trust: 3.6
db:	NVD	id:	CVE-2013-7313	Trust: 2.8
db:	JVN	id:	JVNVU96465452	Trust: 0.8
db:	JVNDB	id:	JVNDB-2013-005895	Trust: 0.8
db:	CERT/CC	id:	HTTP://WWW.KB.CERT.ORG/VULS/ID/BLUU-97KQ26	Trust: 0.6
db:	CNNVD	id:	CNNVD-201401-490	Trust: 0.6
db:	BID	id:	65169	Trust: 0.4
db:	VULHUB	id:	VHN-67315	Trust: 0.1

sources: CERT/CC: VU#229804 // VULHUB: VHN-67315 // BID: 65169 // JVNDB: JVNDB-2013-005895 // CNNVD: CNNVD-201401-490 // NVD: CVE-2013-7313

REFERENCES

url:	http://www.kb.cert.org/vuls/id/bluu-97kq26	Trust: 2.8
url:	http://www.kb.cert.org/vuls/id/229804	Trust: 2.5
url:	http://tools.ietf.org/html/rfc2328	Trust: 0.8
url:	http://en.wikipedia.org/wiki/open_shortest_path_first	Trust: 0.8
url:	https://supportcenter.checkpoint.com/supportcenter/portal?eventsubmit_dogoviewsolutiondetails=&solutionid=sk94490	Trust: 0.8
url:	http://tools.cisco.com/security/center/viewalert.x?alertid=30210	Trust: 0.8
url:	https://cp-enterasys.kb.net/article.aspx?article=15134&p=1	Trust: 0.8
url:	http://www-01.ibm.com/support/docview.wss?uid=isg3t1019716	Trust: 0.8
url:	http://kb.juniper.net/infocenter/index?page=content&id=jsa10582&cat=sirt_1&actp=	Trust: 0.8
url:	http://jpn.nec.com/security-info/secinfo/nv13-006.html	Trust: 0.8
url:	http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html	Trust: 0.8
url:	http://www.rtpro.yamaha.co.jp/rt/faq/security/vu96465452.html	Trust: 0.8
url:	https://kc.mcafee.com/corporate/index?page=content&id=kb79309&actp=list	Trust: 0.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-7313	Trust: 0.8
url:	http://jvn.jp/vu/jvnvu96465452/	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-7313	Trust: 0.8
url:	http://www.juniper.net/	Trust: 0.3
url:	http://www.kb.cert.org/vuls/id/bluu-98ms25	Trust: 0.3

sources: CERT/CC: VU#229804 // VULHUB: VHN-67315 // BID: 65169 // JVNDB: JVNDB-2013-005895 // CNNVD: CNNVD-201401-490 // NVD: CVE-2013-7313

CREDITS

Dr. Gabi Nakibly from Rafael Advanced Defense Systems as joint work he conducted with Eitan Menahem, Yuval Elovici and Ariel Waizel of Telekom Innovation Laboratories at Ben Gurion University

Trust: 0.3

sources: BID: 65169

SOURCES

db:	CERT/CC	id:	VU#229804
db:	VULHUB	id:	VHN-67315
db:	BID	id:	65169
db:	JVNDB	id:	JVNDB-2013-005895
db:	CNNVD	id:	CNNVD-201401-490
db:	NVD	id:	CVE-2013-7313

LAST UPDATE DATE

2024-11-23T21:45:27.529000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#229804	date:	2013-12-06T00:00:00
db:	VULHUB	id:	VHN-67315	date:	2014-01-23T00:00:00
db:	BID	id:	65169	date:	2014-01-23T00:00:00
db:	JVNDB	id:	JVNDB-2013-005895	date:	2014-01-24T00:00:00
db:	CNNVD	id:	CNNVD-201401-490	date:	2014-01-27T00:00:00
db:	NVD	id:	CVE-2013-7313	date:	2024-11-21T02:00:43.257

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#229804	date:	2013-08-02T00:00:00
db:	VULHUB	id:	VHN-67315	date:	2014-01-23T00:00:00
db:	BID	id:	65169	date:	2014-01-23T00:00:00
db:	JVNDB	id:	JVNDB-2013-005895	date:	2014-01-24T00:00:00
db:	CNNVD	id:	CNNVD-201401-490	date:	2014-01-27T00:00:00
db:	NVD	id:	CVE-2013-7313	date:	2014-01-23T17:55:05.573