Details of VAR-201604-0059

ID

VAR-201604-0059

CVE

CVE-2016-1274

TITLE

Juniper QFX Runs on a series switch Junos OS Service disruption in (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2016-002150

DESCRIPTION

Juniper Junos OS 14.1X53 before 14.1X53-D30 on QFX Series switches allows remote attackers to cause a denial of service (PFE panic) via a high rate of unspecified VXLAN packets. Supplementary information : CWE Vulnerability type by CWE-19: Data Handling ( Data processing ) Has been identified. JuniperNetworksQFXSeriesdevicesrunningJunosOS is a set of QFX series switches running network operating systems. Juniper Junos is prone to a denial-of-service vulnerability. An attacker may exploit this issue to cause PFE panic, resulting in a a denial-of-service condition. Juniper Junos 14.1X53 prior to 14.1X53-D30 are vulnerable. The vulnerability is caused by the program not properly handling high frequency VXLAN packets

Trust: 2.52

sources: NVD: CVE-2016-1274 // JVNDB: JVNDB-2016-002150 // CNVD: CNVD-2016-02316 // BID: 86036 // VULHUB: VHN-90093

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2016-02316

AFFECTED PRODUCTS

vendor:	juniper	model:	junos	scope:	eq	version:	14.1x53	Trust: 1.6
vendor:	juniper	model:	qfx10000	scope:	-	version:	-	Trust: 0.8
vendor:	juniper	model:	junos os	scope:	eq	version:	14.1x53-d30	Trust: 0.8
vendor:	juniper	model:	qfx5100	scope:	-	version:	-	Trust: 0.8
vendor:	juniper	model:	qfx5200	scope:	-	version:	-	Trust: 0.8
vendor:	juniper	model:	junos os	scope:	lt	version:	14.1x53	Trust: 0.8
vendor:	juniper	model:	qfx3500	scope:	-	version:	-	Trust: 0.8
vendor:	juniper	model:	qfx3600	scope:	-	version:	-	Trust: 0.8
vendor:	juniper	model:	networks junos os 14.1x53<14.1x53-d30	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2016-02316 // JVNDB: JVNDB-2016-002150 // CNNVD: CNNVD-201604-294 // NVD: CVE-2016-1274

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-1274
value:	HIGH
Trust: 1.0
NVD:	CVE-2016-1274
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2016-02316
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201604-294
value:	HIGH
Trust: 0.6
VULHUB:	VHN-90093
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2016-1274
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2016-02316
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-90093
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-1274
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2016-02316 // VULHUB: VHN-90093 // JVNDB: JVNDB-2016-002150 // CNNVD: CNNVD-201604-294 // NVD: CVE-2016-1274

PROBLEMTYPE DATA

problemtype:	CWE-19	Trust: 1.1
problemtype:	CWE-Other	Trust: 0.8

sources: VULHUB: VHN-90093 // JVNDB: JVNDB-2016-002150 // NVD: CVE-2016-1274

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201604-294

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201604-294

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-002150

PATCH

title:	JSA10747	url:	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10747	Trust: 0.8
title:	JuniperNetworksQFXSeriesVXLAN Packet Denial of Service Vulnerability Patch	url:	https://www.cnvd.org.cn/patchInfo/show/74315	Trust: 0.6
title:	Juniper Networks QFX Series Remediation measures for denial of service vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=60955	Trust: 0.6

sources: CNVD: CNVD-2016-02316 // JVNDB: JVNDB-2016-002150 // CNNVD: CNNVD-201604-294

EXTERNAL IDS

db:	NVD	id:	CVE-2016-1274	Trust: 3.4
db:	JUNIPER	id:	JSA10747	Trust: 2.6
db:	JVNDB	id:	JVNDB-2016-002150	Trust: 0.8
db:	CNNVD	id:	CNNVD-201604-294	Trust: 0.7
db:	CNVD	id:	CNVD-2016-02316	Trust: 0.6
db:	BID	id:	86036	Trust: 0.3
db:	VULHUB	id:	VHN-90093	Trust: 0.1

sources: CNVD: CNVD-2016-02316 // VULHUB: VHN-90093 // BID: 86036 // JVNDB: JVNDB-2016-002150 // CNNVD: CNNVD-201604-294 // NVD: CVE-2016-1274

REFERENCES

url:	http://kb.juniper.net/infocenter/index?page=content&id=jsa10747	Trust: 1.6
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1274	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1274	Trust: 0.8
url:	https://kb.juniper.net/infocenter/index?page=content&id=jsa10747&actp=search	Trust: 0.6
url:	http://www.juniper.net/	Trust: 0.3
url:	http://www.juniper.net/us/en/products-services/nos/junos/	Trust: 0.3
url:	http://kb.juniper.net/infocenter/index?page=content&id=jsa10747&cat=sirt_1&actp=list	Trust: 0.3
url:	http://kb.juniper.net/infocenter/index?page=content&id=jsa10747	Trust: 0.1

sources: CNVD: CNVD-2016-02316 // VULHUB: VHN-90093 // BID: 86036 // JVNDB: JVNDB-2016-002150 // CNNVD: CNNVD-201604-294 // NVD: CVE-2016-1274

CREDITS

The vendor reported this issue.

Trust: 0.3

sources: BID: 86036

SOURCES

db:	CNVD	id:	CNVD-2016-02316
db:	VULHUB	id:	VHN-90093
db:	BID	id:	86036
db:	JVNDB	id:	JVNDB-2016-002150
db:	CNNVD	id:	CNNVD-201604-294
db:	NVD	id:	CVE-2016-1274

LAST UPDATE DATE

2024-11-23T22:45:50.516000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2016-02316	date:	2016-04-19T00:00:00
db:	VULHUB	id:	VHN-90093	date:	2016-04-20T00:00:00
db:	BID	id:	86036	date:	2016-07-06T14:26:00
db:	JVNDB	id:	JVNDB-2016-002150	date:	2016-04-22T00:00:00
db:	CNNVD	id:	CNNVD-201604-294	date:	2016-04-18T00:00:00
db:	NVD	id:	CVE-2016-1274	date:	2024-11-21T02:46:05.177

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2016-02316	date:	2016-04-19T00:00:00
db:	VULHUB	id:	VHN-90093	date:	2016-04-15T00:00:00
db:	BID	id:	86036	date:	2016-04-13T00:00:00
db:	JVNDB	id:	JVNDB-2016-002150	date:	2016-04-22T00:00:00
db:	CNNVD	id:	CNNVD-201604-294	date:	2016-04-14T00:00:00
db:	NVD	id:	CVE-2016-1274	date:	2016-04-15T14:59:09.130