Details of VAR-201710-0243

ID

VAR-201710-0243

CVE

CVE-2017-10611

TITLE

Juniper Networks Junos OS Vulnerabilities in data processing

Trust: 0.8

sources: JVNDB: JVNDB-2017-009394

DESCRIPTION

If extended statistics are enabled via 'set chassis extended-statistics', when executing any operation that fetches interface statistics, including but not limited to SNMP GET requests, the pfem process or the FPC may crash and restart. Repeated crashes of PFE processing can result in an extended denial of service condition. This issue only affects the following platforms: (1) EX2200, EX3300, XRE200 (2) MX Series routers with MPC7E/8E/9E PFEs installed, and only if 'extended-statistics' are enabled under the [edit chassis] configuration. Affected releases are Juniper Networks Junos OS 14.1 prior to 14.1R8-S5, 14.1R9 on MX Series; 14.1X53 prior to 14.1X53-D46, 14.1X53-D50 on EX2200, EX3300, XRE200; 14.2 prior to 14.2R7-S9, 14.2R8 on MX Series; 15.1 prior to 15.1F5-S8, 15.1F6-S8, 15.1R5-S3, 15.1R6 on MX Series; 16.1 prior to 16.1R4-S5, 16.1R5, 16.1R6 on MX Series; 16.1X65 prior to 16.1X65-D45 on EX2200, EX3300, XRE200; 16.2 prior to 16.2R2-S1, 16.2R3 on MX Series; 17.1 prior to 17.1R2-S2, 17.1R3 on MX Series; 17.2 prior to 17.2R1-S3, 17.2R2 on MX Series; 17.2X75 prior to 17.2X75-D50 on MX Series; 17.3 prior to 17.3R1-S1, 17.3R2 on MX Series. No other Juniper Networks products or platforms are affected by this issue. Juniper Networks Junos OS Contains a data processing vulnerability.Denial of service (DoS) May be in a state. The Juniper EX2200, EX3300 and XRE200 are enterprise-class switches. Junos OS is a set of operating systems running on it. A security vulnerability exists in the Junos OS of Juniper EX2200, EX3300, XRE200, and MX Series routers with MPC7E/8E/9E PFEs installed. An attacker can exploit this vulnerability to cause a denial of service (pfem process or FPC crash and restart)

Trust: 1.71

sources: NVD: CVE-2017-10611 // JVNDB: JVNDB-2017-009394 // VULHUB: VHN-100951

AFFECTED PRODUCTS

vendor:	juniper	model:	junos	scope:	eq	version:	16.2	Trust: 1.6
vendor:	juniper	model:	junos	scope:	eq	version:	17.2x75	Trust: 1.6
vendor:	juniper	model:	junos	scope:	eq	version:	17.1	Trust: 1.6
vendor:	juniper	model:	junos	scope:	eq	version:	17.3	Trust: 1.6
vendor:	juniper	model:	junos	scope:	eq	version:	17.2	Trust: 1.6
vendor:	juniper	model:	junos	scope:	eq	version:	16.1x65	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	14.1x53	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	15.1	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	14.2	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	14.1	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	16.1	Trust: 1.0
vendor:	juniper	model:	junos os	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2017-009394 // CNNVD: CNNVD-201710-516 // NVD: CVE-2017-10611

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-10611
value:	MEDIUM
Trust: 1.0
sirt@juniper.net:	CVE-2017-10611
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2017-10611
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201710-516
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-100951
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-10611
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-100951
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-10611
baseSeverity:	MEDIUM
baseScore:	5.9
vectorString:	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	2.2
impactScore:	3.6
version:	3.0
Trust: 1.8
sirt@juniper.net:	CVE-2017-10611
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.0
Trust: 1.0

sources: VULHUB: VHN-100951 // JVNDB: JVNDB-2017-009394 // CNNVD: CNNVD-201710-516 // NVD: CVE-2017-10611 // NVD: CVE-2017-10611

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-19	Trust: 0.9

sources: VULHUB: VHN-100951 // JVNDB: JVNDB-2017-009394 // NVD: CVE-2017-10611

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201710-516

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201710-516

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-009394

PATCH

title:	JSA10814	url:	https://kb.juniper.net/JSA10814	Trust: 0.8
title:	Multiple Juniper Networks product Junos OS Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=75552	Trust: 0.6

sources: JVNDB: JVNDB-2017-009394 // CNNVD: CNNVD-201710-516

EXTERNAL IDS

db:	NVD	id:	CVE-2017-10611	Trust: 2.5
db:	JUNIPER	id:	JSA10814	Trust: 1.7
db:	JVNDB	id:	JVNDB-2017-009394	Trust: 0.8
db:	CNNVD	id:	CNNVD-201710-516	Trust: 0.7
db:	VULHUB	id:	VHN-100951	Trust: 0.1

sources: VULHUB: VHN-100951 // JVNDB: JVNDB-2017-009394 // CNNVD: CNNVD-201710-516 // NVD: CVE-2017-10611

REFERENCES

url:	https://kb.juniper.net/jsa10814	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-10611	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-10611	Trust: 0.8

sources: VULHUB: VHN-100951 // JVNDB: JVNDB-2017-009394 // CNNVD: CNNVD-201710-516 // NVD: CVE-2017-10611

SOURCES

db:	VULHUB	id:	VHN-100951
db:	JVNDB	id:	JVNDB-2017-009394
db:	CNNVD	id:	CNNVD-201710-516
db:	NVD	id:	CVE-2017-10611

LAST UPDATE DATE

2024-08-14T13:46:25.522000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-100951	date:	2019-10-09T00:00:00
db:	JVNDB	id:	JVNDB-2017-009394	date:	2017-11-10T00:00:00
db:	CNNVD	id:	CNNVD-201710-516	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2017-10611	date:	2019-10-09T23:21:40.277

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-100951	date:	2017-10-13T00:00:00
db:	JVNDB	id:	JVNDB-2017-009394	date:	2017-11-10T00:00:00
db:	CNNVD	id:	CNNVD-201710-516	date:	2017-10-18T00:00:00
db:	NVD	id:	CVE-2017-10611	date:	2017-10-13T17:29:00.613