Improper input validation in Juniper Junos
CVE-2017-2314
Receipt of a malformed BGP OPEN message may cause the routing protocol daemon (rpd) process to crash and restart. By continuously sending specially crafted BGP OPEN messages, an attacker can repeatedly crash the rpd process causing prolonged denial of service. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS 12.3 prior to 12.3R12-S4, 12.3R13, 12.3R3-S4; 12.3X48 prior to 12.3X48-D50; 13.3 prior to 13.3R4-S11, 13.3R10; 14.1 prior to 14.1R8-S3, 14.1R9; 14.1X53 prior to 14.1X53-D40; 14.1X55 prior to 14.1X55-D35; 14.2 prior to 14.2R4-S7, 14.2R6-S4, 14.2R7; 15.1 prior to 15.1F2-S11, 15.1F4-S1-J1, 15.1F5-S3, 15.1F6, 15.1R4; 15.1X49 prior to 15.1X49-D100; 15.1X53 prior to 15.1X53-D33, 15.1X53-D50.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.013 (69.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 69th percentile — 69.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: 0.000
Affected products
- Juniper Junos — versions 12.3, 12.3x48, 14.1
- Juniper Networks Junos OS — versions 14.1X53 prior to 14.1X53-D40, 15.1X49 prior to 15.1X49-D100, 14.1 prior to 14.1R8-S3, 14.1R9
Weakness classification (CWE)
References
- kb.juniper.net/JSA10779 (Vendor Advisory)
- www.securitytracker.com/id/1038889 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2017-2314?
- CVE-2017-2314 is a high-severity vulnerability in Juniper Junos, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2017-07-17.
- How severe is CVE-2017-2314?
- High severity. CVSS v3 base score is 7.5 out of 10.