Sign-up

ID

VAR-201807-0315


CVE

CVE-2018-0031


TITLE

Juniper Networks Junos OS Vulnerable to resource exhaustion

Trust: 0.8

sources: JVNDB: JVNDB-2018-007988

DESCRIPTION

Receipt of specially crafted UDP/IP packets over MPLS may be able to bypass a stateless firewall filter. The crafted UDP packets must be encapsulated and meet a very specific packet format to be classified in a way that bypasses IP firewall filter rules. The packets themselves do not cause a service interruption (e.g. RPD crash), but receipt of a high rate of UDP packets may be able to contribute to a denial of service attack. This issue only affects processing of transit UDP/IP packets over MPLS, received on an interface with MPLS enabled. TCP packet processing and non-MPLS encapsulated UDP packet processing are unaffected by this issue. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D76; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D66, 12.3X48-D70; 14.1X53 versions prior to 14.1X53-D47; 15.1 versions prior to 15.1F6-S10, 15.1R4-S9, 15.1R6-S6, 15.1R7; 15.1X49 versions prior to 15.1X49-D131, 15.1X49-D140; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400; 15.1X53 versions prior to 15.1X53-D67 on QFX10K; 15.1X53 versions prior to 15.1X53-D233 on QFX5200/QFX5110; 15.1X53 versions prior to 15.1X53-D471, 15.1X53-D490 on NFX; 16.1 versions prior to 16.1R3-S8, 16.1R4-S9, 16.1R5-S4, 16.1R6-S3, 16.1R7; 16.2 versions prior to 16.2R1-S6, 16.2R2-S5, 16.2R3; 17.1 versions prior to 17.1R1-S7, 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S6, 17.2R2-S4, 17.2R3; 17.2X75 versions prior to 17.2X75-D100; 17.3 versions prior to 17.3R1-S4, 17.3R2-S2, 17.3R3; 17.4 versions prior to 17.4R1-S3, 17.4R2; 18.1 versions prior to 18.1R2; 18.2X75 versions prior to 18.2X75-D5. Juniper Networks Junos OS Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Juniper Junos OS is a set of network operating system of Juniper Networks (Juniper Networks) dedicated to the company's hardware systems. The operating system provides a secure programming interface and Junos SDK. A security vulnerability exists in Juniper Junos OS

Trust: 1.71

sources: NVD: CVE-2018-0031 // JVNDB: JVNDB-2018-007988 // VULHUB: VHN-118233

AFFECTED PRODUCTS

vendor:junipermodel:junosscope:eqversion:16.2

Trust: 1.6

vendor:junipermodel:junosscope:eqversion:12.1x46

Trust: 1.6

vendor:junipermodel:junosscope:eqversion:16.1

Trust: 1.6

vendor:junipermodel:junosscope:eqversion:15.1x53

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:17.3

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:17.1

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:17.4

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:18.1

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:15.1

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:14.1x53

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:12.3x48

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:15.1x49

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:12.3

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:18.2x75

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:17.2x75

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:17.2

Trust: 1.0

vendor:junipermodel:junos osscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2018-007988 // CNNVD: CNNVD-201807-1085 // NVD: CVE-2018-0031

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-0031
value: MEDIUM

Trust: 1.0

sirt@juniper.net: CVE-2018-0031
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-0031
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201807-1085
value: MEDIUM

Trust: 0.6

VULHUB: VHN-118233
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-0031
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-118233
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-0031
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 3.6
version: 3.0

Trust: 1.8

sirt@juniper.net: CVE-2018-0031
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.0

Trust: 1.0

sources: VULHUB: VHN-118233 // JVNDB: JVNDB-2018-007988 // CNNVD: CNNVD-201807-1085 // NVD: CVE-2018-0031 // NVD: CVE-2018-0031

PROBLEMTYPE DATA

problemtype:CWE-400

Trust: 1.9

sources: VULHUB: VHN-118233 // JVNDB: JVNDB-2018-007988 // NVD: CVE-2018-0031

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201807-1085

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201807-1085

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-007988

PATCH
title:JSA10865url:https://kb.juniper.net/JSA10865
Trust: 0.8
title:Juniper Junos OS Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=82101
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2018-007988 // 
            
            
            
            CNNVD: CNNVD-201807-1085

EXTERNAL IDS
db:NVDid:CVE-2018-0031
Trust: 2.5
db:JUNIPERid:JSA10865
Trust: 1.7
db:SECTRACKid:1041326
Trust: 1.7
db:JVNDBid:JVNDB-2018-007988
Trust: 0.8
db:CNNVDid:CNNVD-201807-1085
Trust: 0.7
db:VULHUBid:VHN-118233
Trust: 0.1
sources:
            
            
            VULHUB: VHN-118233 // 
            
            
            
            JVNDB: JVNDB-2018-007988 // 
            
            
            
            CNNVD: CNNVD-201807-1085 // 
            
            
            
            NVD: CVE-2018-0031

REFERENCES
url:https://kb.juniper.net/jsa10865
Trust: 1.7
url:http://www.securitytracker.com/id/1041326
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0031
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-0031
Trust: 0.8
sources:
            
            
            VULHUB: VHN-118233 // 
            
            
            
            JVNDB: JVNDB-2018-007988 // 
            
            
            
            CNNVD: CNNVD-201807-1085 // 
            
            
            
            NVD: CVE-2018-0031

SOURCES
db:VULHUBid:VHN-118233
db:JVNDBid:JVNDB-2018-007988
db:CNNVDid:CNNVD-201807-1085
db:NVDid:CVE-2018-0031

LAST UPDATE DATE
2024-08-14T15:23:24.955000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-118233date:2019-10-09T00:00:00
db:JVNDBid:JVNDB-2018-007988date:2018-10-04T00:00:00
db:CNNVDid:CNNVD-201807-1085date:2019-10-17T00:00:00
db:NVDid:CVE-2018-0031date:2019-10-09T23:31:02.050

SOURCES RELEASE DATE
db:VULHUBid:VHN-118233date:2018-07-11T00:00:00
db:JVNDBid:JVNDB-2018-007988date:2018-10-04T00:00:00
db:CNNVDid:CNNVD-201807-1085date:2018-07-12T00:00:00
db:NVDid:CVE-2018-0031date:2018-07-11T18:29:00.510