Sign-up

ID

VAR-202007-0719


CVE

CVE-2020-1644


TITLE

Juniper Networks Junos OS and Junos OS Evolved Input verification vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2020-008313

DESCRIPTION

On Juniper Networks Junos OS and Junos OS Evolved devices, the receipt of a specific BGP UPDATE packet causes an internal counter to be incremented incorrectly, which over time can lead to the routing protocols process (RPD) crash and restart. This issue affects both IBGP and EBGP multihop deployment in IPv4 or IPv6 network. This issue affects: Juniper Networks Junos OS: 17.2X75 versions prior to 17.2X75-D105.19; 17.3 versions prior to 17.3R3-S8; 17.4 versions prior to 17.4R2-S10, 17.4R3-S2; 18.1 versions prior to 18.1R3-S10; 18.2 versions prior to 18.2R2-S7, 18.2R3-S4; 18.2X75 versions prior to 18.2X75-D13, 18.2X75-D411.1, 18.2X75-D420.18, 18.2X75-D52.3, 18.2X75-D60; 18.3 versions prior to 18.3R2-S4, 18.3R3-S2; 18.4 versions prior to 18.4R1-S7, 18.4R2-S4, 18.4R3-S2; 19.1 versions prior to 19.1R1-S5, 19.1R2-S1, 19.1R3; 19.2 versions prior to 19.2R1-S5, 19.2R2; 19.3 versions prior to 19.3R2-S2, 19.3R3; 19.4 versions prior to 19.4R1-S2, 19.4R2. Juniper Networks Junos OS Evolved: any releases prior to 20.1R2-EVO. This issue does not affect Juniper Networks Junos OS releases prior to 17.3R1

Trust: 1.71

sources: NVD: CVE-2020-1644 // JVNDB: JVNDB-2020-008313 // VULHUB: VHN-169518

AFFECTED PRODUCTS

vendor:junipermodel:junos os evolvedscope:eqversion:19.1

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:19.2

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:18.2

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:18.2x75

Trust: 1.0

vendor:junipermodel:junos os evolvedscope:eqversion:19.2

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:17.2x75

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:18.3

Trust: 1.0

vendor:junipermodel:junos os evolvedscope:eqversion:20.1

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:18.4

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:19.3

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:17.3

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:19.1

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:19.4

Trust: 1.0

vendor:junipermodel:junos os evolvedscope:eqversion:18.3

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:17.4

Trust: 1.0

vendor:junipermodel:junos os evolvedscope:eqversion:19.3

Trust: 1.0

vendor:junipermodel:junosscope:eqversion:18.1

Trust: 1.0

vendor:junipermodel:junos osscope: - version: -

Trust: 0.8

vendor:junipermodel:junos os evolvedscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2020-008313 // NVD: CVE-2020-1644

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-1644
value: HIGH

Trust: 1.0

sirt@juniper.net: CVE-2020-1644
value: HIGH

Trust: 1.0

NVD: JVNDB-2020-008313
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202007-415
value: HIGH

Trust: 0.6

VULHUB: VHN-169518
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-1644
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2020-008313
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-169518
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-1644
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 2.0

NVD: JVNDB-2020-008313
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-169518 // JVNDB: JVNDB-2020-008313 // CNNVD: CNNVD-202007-415 // NVD: CVE-2020-1644 // NVD: CVE-2020-1644

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

problemtype:CWE-703

Trust: 1.0

sources: VULHUB: VHN-169518 // JVNDB: JVNDB-2020-008313 // NVD: CVE-2020-1644

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202007-415

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202007-415

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2020-008313

PATCH
title:JSA11032url:https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11032&actp=METADATA
Trust: 0.8
title:Juniper Networks Junos OS Enter the fix for the verification error vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=124864
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2020-008313 // 
            
            
            
            CNNVD: CNNVD-202007-415

EXTERNAL IDS
db:NVDid:CVE-2020-1644
Trust: 2.5
db:JUNIPERid:JSA11032
Trust: 1.7
db:JVNDBid:JVNDB-2020-008313
Trust: 0.8
db:AUSCERTid:ESB-2020.2349
Trust: 0.6
db:CNNVDid:CNNVD-202007-415
Trust: 0.6
db:VULHUBid:VHN-169518
Trust: 0.1
sources:
            
            
            VULHUB: VHN-169518 // 
            
            
            
            JVNDB: JVNDB-2020-008313 // 
            
            
            
            CNNVD: CNNVD-202007-415 // 
            
            
            
            NVD: CVE-2020-1644

REFERENCES
url:https://kb.juniper.net/jsa11032
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2020-1644
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-1644
Trust: 0.8
url:https://www.auscert.org.au/bulletins/esb-2020.2349/
Trust: 0.6
url:https://vigilance.fr/vulnerability/junos-os-denial-of-service-via-bgp-update-32772
Trust: 0.6
sources:
            
            
            VULHUB: VHN-169518 // 
            
            
            
            JVNDB: JVNDB-2020-008313 // 
            
            
            
            CNNVD: CNNVD-202007-415 // 
            
            
            
            NVD: CVE-2020-1644

SOURCES
db:VULHUBid:VHN-169518
db:JVNDBid:JVNDB-2020-008313
db:CNNVDid:CNNVD-202007-415
db:NVDid:CVE-2020-1644

LAST UPDATE DATE
2024-11-23T22:58:11.358000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-169518date:2020-07-24T00:00:00
db:JVNDBid:JVNDB-2020-008313date:2020-09-08T00:00:00
db:CNNVDid:CNNVD-202007-415date:2020-07-27T00:00:00
db:NVDid:CVE-2020-1644date:2024-11-21T05:11:04.090

SOURCES RELEASE DATE
db:VULHUBid:VHN-169518date:2020-07-17T00:00:00
db:JVNDBid:JVNDB-2020-008313date:2020-09-08T00:00:00
db:CNNVDid:CNNVD-202007-415date:2020-07-09T00:00:00
db:NVDid:CVE-2020-1644date:2020-07-17T19:15:12.877