Sign-up

ID

VAR-201707-0298


CVE

CVE-2017-2346


TITLE

Juniper Networks MX Run on the platform Junos OS Data processing vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-006081

DESCRIPTION

An MS-MPC or MS-MIC Service PIC may crash when large fragmented packets are passed through an Application Layer Gateway (ALG). Repeated crashes of the Service PC can result in an extended denial of service condition. The issue can be seen only if NAT or stateful-firewall rules are configured with ALGs enabled. This issue was caused by the code change for PR 1182910 in Junos OS 14.1X55-D30, 14.1X55-D35, 14.2R7, 15.1R5, and 16.1R2. No other versions of Junos OS and no other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS on MX platforms running: 14.1X55 from 14.1X55-D30 to releases prior to 14.1X55-D35; 14.2R from 14.2R7 to releases prior to 14.2R7-S4, 14.2R8; 15.1R from 15.1R5 to releases prior to 15.1R5-S2, 15.1R6; 16.1R from 16.1R2 to releases prior to 16.1R3-S2, 16.1R4. Juniper MX Series is an MX series router product of Juniper Networks. Junos OS is a set of operating systems used in it. A security vulnerability exists in Junos OS in Juniper MX Series devices

Trust: 1.71

sources: NVD: CVE-2017-2346 // JVNDB: JVNDB-2017-006081 // VULHUB: VHN-110549

AFFECTED PRODUCTS

vendor:junipermodel:junosscope:eqversion:14.2

Trust: 1.6

vendor:junipermodel:junosscope:eqversion:14.1x55

Trust: 1.6

vendor:junipermodel:junosscope:eqversion:16.1

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:15.1

Trust: 1.0

vendor:junipermodel:junos osscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2017-006081 // CNNVD: CNNVD-201707-614 // NVD: CVE-2017-2346

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-2346
value: MEDIUM

Trust: 1.0

sirt@juniper.net: CVE-2017-2346
value: MEDIUM

Trust: 1.0

NVD: CVE-2017-2346
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201707-614
value: MEDIUM

Trust: 0.6

VULHUB: VHN-110549
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-2346
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-110549
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-2346
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 3.6
version: 3.0

Trust: 2.8

sources: VULHUB: VHN-110549 // JVNDB: JVNDB-2017-006081 // CNNVD: CNNVD-201707-614 // NVD: CVE-2017-2346 // NVD: CVE-2017-2346

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-19

Trust: 0.9

sources: VULHUB: VHN-110549 // JVNDB: JVNDB-2017-006081 // NVD: CVE-2017-2346

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201707-614

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201707-614

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-006081

PATCH
title:JSA10794url:https://kb.juniper.net/JSA10794
Trust: 0.8
title:Juniper MX Series device Junos OS Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=71732
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2017-006081 // 
            
            
            
            CNNVD: CNNVD-201707-614

EXTERNAL IDS
db:NVDid:CVE-2017-2346
Trust: 2.5
db:SECTRACKid:1038895
Trust: 1.7
db:JUNIPERid:JSA10794
Trust: 1.7
db:JVNDBid:JVNDB-2017-006081
Trust: 0.8
db:CNNVDid:CNNVD-201707-614
Trust: 0.7
db:VULHUBid:VHN-110549
Trust: 0.1
sources:
            
            
            VULHUB: VHN-110549 // 
            
            
            
            JVNDB: JVNDB-2017-006081 // 
            
            
            
            CNNVD: CNNVD-201707-614 // 
            
            
            
            NVD: CVE-2017-2346

REFERENCES
url:https://kb.juniper.net/jsa10794
Trust: 1.7
url:http://www.securitytracker.com/id/1038895
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-2346
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-2346
Trust: 0.8
sources:
            
            
            VULHUB: VHN-110549 // 
            
            
            
            JVNDB: JVNDB-2017-006081 // 
            
            
            
            CNNVD: CNNVD-201707-614 // 
            
            
            
            NVD: CVE-2017-2346

SOURCES
db:VULHUBid:VHN-110549
db:JVNDBid:JVNDB-2017-006081
db:CNNVDid:CNNVD-201707-614
db:NVDid:CVE-2017-2346

LAST UPDATE DATE
2024-11-23T23:08:58.113000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-110549date:2019-10-09T00:00:00
db:JVNDBid:JVNDB-2017-006081date:2017-08-17T00:00:00
db:CNNVDid:CNNVD-201707-614date:2019-10-17T00:00:00
db:NVDid:CVE-2017-2346date:2024-11-21T03:23:20.133

SOURCES RELEASE DATE
db:VULHUBid:VHN-110549date:2017-07-17T00:00:00
db:JVNDBid:JVNDB-2017-006081date:2017-08-17T00:00:00
db:CNNVDid:CNNVD-201707-614date:2017-07-19T00:00:00
db:NVDid:CVE-2017-2346date:2017-07-17T13:18:24.500