Details of VAR-201707-0294

ID

VAR-201707-0294

CVE

CVE-2017-2342

TITLE

Junos OS Vulnerabilities related to security functions

Trust: 0.8

sources: JVNDB: JVNDB-2017-006937

DESCRIPTION

MACsec feature on Juniper Networks Junos OS 15.1X49 prior to 15.1X49-D100 on SRX300 series does not report errors when a secure link can not be established. It falls back to an unencrypted link. This can happen when MACsec is configured on ports that are not capable of MACsec or when a secure link can not be established. This can mislead customers into believing that a link is secure. On SRX 300 series devices, prior to 15.1X49-D100, MACsec was only supported on control and fabric ports of SRX340 and SRX345 devices. SRX300 and and SRX320 did not have any MACsec capable ports. Configuring MACsec on ports that were not MACsec capable would have resulted in this issue. Affected releases are Juniper Networks Junos OS 15.1X49 prior to 15.1X49-D100 on SRX300 series. Junos OS Contains vulnerabilities related to security features.Information may be obtained and information may be altered. Junos OS is the operating system that runs on it. A remote attacker could exploit this vulnerability to view sensitive information on the target system

Trust: 1.71

sources: NVD: CVE-2017-2342 // JVNDB: JVNDB-2017-006937 // VULHUB: VHN-110545

AFFECTED PRODUCTS

vendor:	juniper	model:	junos	scope:	eq	version:	15.1x49	Trust: 1.6
vendor:	juniper	model:	junos os	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2017-006937 // CNNVD: CNNVD-201707-610 // NVD: CVE-2017-2342

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-2342
value:	HIGH
Trust: 1.0
sirt@juniper.net:	CVE-2017-2342
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-2342
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201707-610
value:	HIGH
Trust: 0.6
VULHUB:	VHN-110545
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-2342
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:A/AC:M/AU:N/C:P/I:P/A:N
accessVector:	ADJACENT_NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	5.5
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-110545
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:A/AC:M/AU:N/C:P/I:P/A:N
accessVector:	ADJACENT_NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	5.5
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-2342
baseSeverity:	HIGH
baseScore:	8.1
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	5.2
version:	3.0
Trust: 2.8

sources: VULHUB: VHN-110545 // JVNDB: JVNDB-2017-006937 // CNNVD: CNNVD-201707-610 // NVD: CVE-2017-2342 // NVD: CVE-2017-2342

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-392	Trust: 1.0
problemtype:	CWE-254	Trust: 0.9

sources: VULHUB: VHN-110545 // JVNDB: JVNDB-2017-006937 // NVD: CVE-2017-2342

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-201707-610

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201707-610

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-006937

PATCH

title:	JSA10790	url:	https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10790&actp=METADATA	Trust: 0.8
title:	Juniper SRX300 Series device Junos OS Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=71729	Trust: 0.6

sources: JVNDB: JVNDB-2017-006937 // CNNVD: CNNVD-201707-610

EXTERNAL IDS

db:	NVD	id:	CVE-2017-2342	Trust: 2.5
db:	SECTRACK	id:	1038890	Trust: 1.7
db:	JUNIPER	id:	JSA10790	Trust: 1.7
db:	JVNDB	id:	JVNDB-2017-006937	Trust: 0.8
db:	CNNVD	id:	CNNVD-201707-610	Trust: 0.7
db:	VULHUB	id:	VHN-110545	Trust: 0.1

sources: VULHUB: VHN-110545 // JVNDB: JVNDB-2017-006937 // CNNVD: CNNVD-201707-610 // NVD: CVE-2017-2342

REFERENCES

url:	https://kb.juniper.net/jsa10790	Trust: 1.7
url:	http://www.securitytracker.com/id/1038890	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-2342	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-2342	Trust: 0.8

sources: VULHUB: VHN-110545 // JVNDB: JVNDB-2017-006937 // CNNVD: CNNVD-201707-610 // NVD: CVE-2017-2342

SOURCES

db:	VULHUB	id:	VHN-110545
db:	JVNDB	id:	JVNDB-2017-006937
db:	CNNVD	id:	CNNVD-201707-610
db:	NVD	id:	CVE-2017-2342

LAST UPDATE DATE

2024-08-14T15:44:23.361000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-110545	date:	2019-10-09T00:00:00
db:	JVNDB	id:	JVNDB-2017-006937	date:	2017-09-07T00:00:00
db:	CNNVD	id:	CNNVD-201707-610	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2017-2342	date:	2019-10-09T23:26:45.070

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-110545	date:	2017-07-17T00:00:00
db:	JVNDB	id:	JVNDB-2017-006937	date:	2017-09-07T00:00:00
db:	CNNVD	id:	CNNVD-201707-610	date:	2017-07-19T00:00:00
db:	NVD	id:	CVE-2017-2342	date:	2017-07-17T13:18:24.267