Details of VAR-201810-0065

ID

VAR-201810-0065

CVE

CVE-2018-0043

TITLE

Juniper Networks Junos OS Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-013701

DESCRIPTION

Receipt of a specific MPLS packet may cause the routing protocol daemon (RPD) process to crash and restart or may lead to remote code execution. By continuously sending specific MPLS packets, an attacker can repeatedly crash the RPD process causing a sustained Denial of Service. This issue affects both IPv4 and IPv6. This issue can only be exploited from within the MPLS domain. End-users connected to the CE device cannot cause this crash. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D75 on SRX Series; 14.1X53 versions prior to 14.1X53-D47 on QFX/EX Series; 14.1X53 versions prior to 14.1X53-D130 on QFabric Series; 15.1F6 versions prior to 15.1F6-S10; 15.1 versions prior to 15.1R4-S9 15.1R7; 15.1X49 versions prior to 15.1X49-D140 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400 Series; 15.1X53 versions prior to 15.1X53-D67 on QFX10K Series; 15.1X53 versions prior to 15.1X53-D233 on QFX5200/QFX5110 Series; 15.1X53 versions prior to 15.1X53-D471 15.1X53-D490 on NFX Series; 16.1 versions prior to 16.1R3-S8 16.1R4-S8 16.1R5-S4 16.1R6-S4 16.1R7; 16.1X65 versions prior to 16.1X65-D48; 16.2 versions prior to 16.2R1-S6 16.2R3; 17.1 versions prior to 17.1R1-S7 17.1R2-S6 17.1R3; 17.2 versions prior to 17.2R1-S6 17.2R2-S3 17.2R3; 17.2X75 versions prior to 17.2X75-D100 17.2X75-D42 17.2X75-D91; 17.3 versions prior to 17.3R1-S4 17.3R2-S2 17.3R3; 17.4 versions prior to 17.4R1-S3 17.4R2 . No other Juniper Networks products or platforms are affected by this issue. Juniper Networks Junos OS Contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The operating system provides a secure programming interface and Junos SDK. A security vulnerability exists in Juniper Junos OS

Trust: 1.71

sources: NVD: CVE-2018-0043 // JVNDB: JVNDB-2018-013701 // VULHUB: VHN-118245

AFFECTED PRODUCTS

vendor:	juniper	model:	junos	scope:	eq	version:	15.1x53	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	17.3	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	17.1	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	17.4	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	15.1	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	14.1x53	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	12.3x48	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	15.1x49	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	16.2	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	12.1x46	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	16.1	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	12.3	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	16.1x65	Trust: 1.0
vendor:	juniper	model:	junos	scope:	eq	version:	17.2x75	Trust: 1.0
vendor:	juniper	model:	junos os	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2018-013701 // NVD: CVE-2018-0043

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-0043
value:	HIGH
Trust: 1.0
sirt@juniper.net:	CVE-2018-0043
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-0043
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201810-511
value:	HIGH
Trust: 0.6
VULHUB:	VHN-118245
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-0043
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	6.5
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-118245
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	6.5
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-0043
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 2.8

sources: VULHUB: VHN-118245 // JVNDB: JVNDB-2018-013701 // CNNVD: CNNVD-201810-511 // NVD: CVE-2018-0043 // NVD: CVE-2018-0043

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-118245 // JVNDB: JVNDB-2018-013701 // NVD: CVE-2018-0043

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-201810-511

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201810-511

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-013701

PATCH

title:	JSA10877	url:	https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10877&actp=METADATA	Trust: 0.8
title:	Juniper Junos OS Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=86097	Trust: 0.6

sources: JVNDB: JVNDB-2018-013701 // CNNVD: CNNVD-201810-511

EXTERNAL IDS

db:	NVD	id:	CVE-2018-0043	Trust: 2.5
db:	JUNIPER	id:	JSA10877	Trust: 1.7
db:	SECTRACK	id:	1041847	Trust: 1.7
db:	JVNDB	id:	JVNDB-2018-013701	Trust: 0.8
db:	CNNVD	id:	CNNVD-201810-511	Trust: 0.7
db:	VULHUB	id:	VHN-118245	Trust: 0.1

sources: VULHUB: VHN-118245 // JVNDB: JVNDB-2018-013701 // CNNVD: CNNVD-201810-511 // NVD: CVE-2018-0043

REFERENCES

url:	https://kb.juniper.net/jsa10877	Trust: 1.7
url:	http://www.securitytracker.com/id/1041847	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0043	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-0043	Trust: 0.8

sources: VULHUB: VHN-118245 // JVNDB: JVNDB-2018-013701 // CNNVD: CNNVD-201810-511 // NVD: CVE-2018-0043

SOURCES

db:	VULHUB	id:	VHN-118245
db:	JVNDB	id:	JVNDB-2018-013701
db:	CNNVD	id:	CNNVD-201810-511
db:	NVD	id:	CVE-2018-0043

LAST UPDATE DATE

2024-08-14T14:32:56.641000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-118245	date:	2019-10-09T00:00:00
db:	JVNDB	id:	JVNDB-2018-013701	date:	2019-02-28T00:00:00
db:	CNNVD	id:	CNNVD-201810-511	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-0043	date:	2021-06-21T14:01:45.470

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-118245	date:	2018-10-10T00:00:00
db:	JVNDB	id:	JVNDB-2018-013701	date:	2019-02-28T00:00:00
db:	CNNVD	id:	CNNVD-201810-511	date:	2018-10-11T00:00:00
db:	NVD	id:	CVE-2018-0043	date:	2018-10-10T18:29:00.327