Sign-up

ID

VAR-201707-0297


CVE

CVE-2017-2345


TITLE

Junos OS Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-006939

DESCRIPTION

On Junos OS devices with SNMP enabled, a network based attacker with unfiltered access to the RE can cause the Junos OS snmpd daemon to crash and restart by sending a crafted SNMP packet. Repeated crashes of the snmpd daemon can result in a partial denial of service condition. Additionally, it may be possible to craft a malicious SNMP packet in a way that can result in remote code execution. SNMP is disabled in Junos OS by default. Junos OS devices with SNMP disabled are not affected by this issue. No other Juniper Networks products or platforms are affected by this issue. NOTE: This is a different issue than Cisco CVE-2017-6736, CVE-2017-6737, and CVE-2017-6738. Affected releases are Juniper Networks Junos OS 12.1X46 prior to 12.1X46-D67; 12.3X48 prior to 12.3X48-D51, 12.3X48-D55; 13.3 prior to 13.3R10-S2; 14.1 prior to 14.1R2-S10, 14.1R8-S4, 14.1R9; 14.1X50 prior to 14.1X50-D185; 14.1X53 prior to 14.1X53-D122, 14.1X53-D44, 14.1X53-D50; 14.2 prior to 14.2R4-S9, 14.2R7-S7, 14.2R8; 15.1 prior to 15.1F2-S18, 15.1F6-S7, 15.1R4-S8, 15.1R5-S5, 15.1R6-S1, 15.1R7; 15.1X49 prior to 15.1X49-D100, 15.1X49-D110; 15.1X53 prior to 15.1X53-D231, 15.1X53-D47, 15.1X53-D48, 15.1X53-D57, 15.1X53-D64, 15.1X53-D70; 16.1 prior to 16.1R3-S4, 16.1R4-S3, 16.1R4-S4, 16.1R5; 16.2 prior to 16.2R2, 16.2R3; 17.1 prior to 17.1R1-S3, 17.1R2, 17.1R3; 17.2 prior to 17.2R1-S1, 17.2R2; 17.2X75 prior to 17.2X75-D30. Junos releases prior to 10.2 are not affected. Junos OS Contains an input validation vulnerability. This vulnerability is CVE-2017-6736 , CVE-2017-6737 ,and CVE-2017-6738 This is a different vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Juniper Junos is prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause the snmpd daemon to crash and restart the affected device, denying service to legitimate users. This issue could be exploited to execute arbitrary code; however, this has not been confirmed. The operating system provides a secure programming interface and Junos SDK

Trust: 1.98

sources: NVD: CVE-2017-2345 // JVNDB: JVNDB-2017-006939 // BID: 99567 // VULHUB: VHN-110548

AFFECTED PRODUCTS

vendor:junipermodel:junosscope:eqversion:16.2

Trust: 1.6

vendor:junipermodel:junosscope:eqversion:17.1

Trust: 1.6

vendor:junipermodel:junosscope:eqversion:17.2x75

Trust: 1.6

vendor:junipermodel:junosscope:eqversion:17.2

Trust: 1.6

vendor:junipermodel:junosscope:eqversion:15.1x53

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:13.3

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:15.1

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:14.1x53

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:12.3x48

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:15.1x49

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:14.1x50

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:12.1x46

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:16.1

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:14.2

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:14.1

Trust: 1.0

vendor:junipermodel:junos osscope: - version: -

Trust: 0.8

vendor:junipermodel:junos 15.1x53-d70scope: - version: -

Trust: 0.3

vendor:junipermodel:junosscope:eqversion:11.4x27.62

Trust: 0.3

vendor:junipermodel:junosscope:eqversion:11.4x27.44

Trust: 0.3

vendor:junipermodel:junosscope:eqversion:11.4x27.43

Trust: 0.3

vendor:junipermodel:junosscope:eqversion:11.4x27

Trust: 0.3

vendor:junipermodel:junos 11.4r9-s1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r9scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r8scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r7.5scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r7-s2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r7-s1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r7scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r6.6scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r6-s2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r5.5scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r5-s2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r4.4scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r3.7scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r2.14scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r13-s3scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r13-s2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r13-s1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r13scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r12-s4scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r12-s1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r12scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r11.4scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r11scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r10.3scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r10-s1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r10scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r1.6scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.4r1scope: - version: -

Trust: 0.3

vendor:junipermodel:junos r9scope:eqversion:11.4

Trust: 0.3

vendor:junipermodel:junos r8scope:eqversion:11.4

Trust: 0.3

vendor:junipermodel:junos r7scope:eqversion:11.4

Trust: 0.3

vendor:junipermodel:junos r6scope:eqversion:11.4

Trust: 0.3

vendor:junipermodel:junos r5scope:eqversion:11.4

Trust: 0.3

vendor:junipermodel:junos r4scope:eqversion:11.4

Trust: 0.3

vendor:junipermodel:junos r3scope:eqversion:11.4

Trust: 0.3

vendor:junipermodel:junos r2scope:eqversion:11.4

Trust: 0.3

vendor:junipermodel:junos r12scope:eqversion:11.4

Trust: 0.3

vendor:junipermodel:junos r11scope:eqversion:11.4

Trust: 0.3

vendor:junipermodel:junos r10scope:eqversion:11.4

Trust: 0.3

vendor:junipermodel:junos r1scope:eqversion:11.4

Trust: 0.3

vendor:junipermodel:junosscope:eqversion:11.4

Trust: 0.3

vendor:junipermodel:junos 11.3r5.3scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.3r4.2scope: - version: -

Trust: 0.3

vendor:junipermodel:junosscope:eqversion:11.3

Trust: 0.3

vendor:junipermodel:junos 11.2r2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.2r1.2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.2r1scope: - version: -

Trust: 0.3

vendor:junipermodel:junosscope:eqversion:11.2

Trust: 0.3

vendor:junipermodel:junos 11.1r5scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 11.1r4scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 10.4s15scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 10.4s14scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 10.4s13scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 10.4sscope: - version: -

Trust: 0.3

vendor:junipermodel:junos 10.4r9.2scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 10.4r7scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 10.4r6scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 10.4r16scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 10.4r15scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 10.4r14scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 10.4r13scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 10.4r11scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 10.4r10scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 10.4rscope: - version: -

Trust: 0.3

vendor:junipermodel:junosscope:eqversion:10.4

Trust: 0.3

vendor:junipermodel:junosscope:eqversion:10.3

Trust: 0.3

vendor:junipermodel:junos 10.2s10scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 10.2r3scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 10.2r2scope: - version: -

Trust: 0.3

vendor:junipermodel:junosscope:eqversion:10.2

Trust: 0.3

vendor:junipermodel:junos 17.3r1scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 17.2r2scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 17.2r1-s1scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 17.1r2scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 17.1r1-s3scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 16.2r2scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 16.1r5scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 16.1r4-s3scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 16.1r3-s4scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 15.1x53-d64scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 15.1x53-d57scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 15.1x53-d48scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 15.1x53-d47scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 15.1x53-d231scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d100scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 15.1r7scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 15.1r6-s1scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 15.1r5-s5scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 15.1r4-s8scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 15.1f6-s7scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 15.1f2-s18scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 14.2r8scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 14.2r7-s7scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 14.1x53-d50scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 14.1x53-d44scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 14.1x53-d122scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 14.1r9scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 14.1r8-s4scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 14.1r2-s10scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 13.3r10-s2scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d55scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d51scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d67scope:neversion: -

Trust: 0.3

sources: BID: 99567 // JVNDB: JVNDB-2017-006939 // CNNVD: CNNVD-201707-597 // NVD: CVE-2017-2345

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-2345
value: CRITICAL

Trust: 1.0

sirt@juniper.net: CVE-2017-2345
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-2345
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201707-597
value: CRITICAL

Trust: 0.6

VULHUB: VHN-110548
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-2345
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-110548
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-2345
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 2.8

sources: VULHUB: VHN-110548 // JVNDB: JVNDB-2017-006939 // CNNVD: CNNVD-201707-597 // NVD: CVE-2017-2345 // NVD: CVE-2017-2345

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-110548 // JVNDB: JVNDB-2017-006939 // NVD: CVE-2017-2345

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201707-597

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201707-597

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-006939

PATCH
title:JSA10793url:https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10793&actp=METADATA
Trust: 0.8
title:Juniper Junos Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=71712
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2017-006939 // 
            
            
            
            CNNVD: CNNVD-201707-597

EXTERNAL IDS
db:NVDid:CVE-2017-2345
Trust: 2.8
db:BIDid:99567
Trust: 2.0
db:JUNIPERid:JSA10793
Trust: 2.0
db:SECTRACKid:1038903
Trust: 1.7
db:JVNDBid:JVNDB-2017-006939
Trust: 0.8
db:CNNVDid:CNNVD-201707-597
Trust: 0.7
db:VULHUBid:VHN-110548
Trust: 0.1
sources:
            
            
            VULHUB: VHN-110548 // 
            
            
            
            BID: 99567 // 
            
            
            
            JVNDB: JVNDB-2017-006939 // 
            
            
            
            CNNVD: CNNVD-201707-597 // 
            
            
            
            NVD: CVE-2017-2345

REFERENCES
url:http://www.securityfocus.com/bid/99567
Trust: 1.7
url:https://kb.juniper.net/jsa10793
Trust: 1.7
url:http://www.securitytracker.com/id/1038903
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-2345
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-2345
Trust: 0.8
url:http://www.juniper.net/
Trust: 0.3
url:http://www.juniper.net/us/en/products-services/nos/junos/
Trust: 0.3
url:https://kb.juniper.net/infocenter/index?page=content&id=jsa10793
Trust: 0.3
sources:
            
            
            VULHUB: VHN-110548 // 
            
            
            
            BID: 99567 // 
            
            
            
            JVNDB: JVNDB-2017-006939 // 
            
            
            
            CNNVD: CNNVD-201707-597 // 
            
            
            
            NVD: CVE-2017-2345

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 99567

SOURCES
db:VULHUBid:VHN-110548
db:BIDid:99567
db:JVNDBid:JVNDB-2017-006939
db:CNNVDid:CNNVD-201707-597
db:NVDid:CVE-2017-2345

LAST UPDATE DATE
2024-08-14T15:39:33.578000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-110548date:2019-10-09T00:00:00
db:BIDid:99567date:2017-07-13T00:00:00
db:JVNDBid:JVNDB-2017-006939date:2017-09-07T00:00:00
db:CNNVDid:CNNVD-201707-597date:2019-10-17T00:00:00
db:NVDid:CVE-2017-2345date:2019-10-09T23:26:45.757

SOURCES RELEASE DATE
db:VULHUBid:VHN-110548date:2017-07-17T00:00:00
db:BIDid:99567date:2017-07-13T00:00:00
db:JVNDBid:JVNDB-2017-006939date:2017-09-07T00:00:00
db:CNNVDid:CNNVD-201707-597date:2017-07-14T00:00:00
db:NVDid:CVE-2017-2345date:2017-07-17T13:18:24.453