mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-07-30 18:04:30 +00:00
179 lines
8.4 KiB
JSON
179 lines
8.4 KiB
JSON
{
|
|
"CVE_data_meta": {
|
|
"ASSIGNER": "sirt@juniper.net",
|
|
"DATE_PUBLIC": "2021-04-14T16:00:00.000Z",
|
|
"ID": "CVE-2021-0234",
|
|
"STATE": "PUBLIC",
|
|
"TITLE": "Junos OS: QFX5100-96S: DDoS protection does not work as expected."
|
|
},
|
|
"affects": {
|
|
"vendor": {
|
|
"vendor_data": [
|
|
{
|
|
"product": {
|
|
"product_data": [
|
|
{
|
|
"product_name": "Junos OS",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"platform": "QFX5100-96S",
|
|
"version_affected": "<",
|
|
"version_name": "17.3",
|
|
"version_value": "17.3R3-S10"
|
|
},
|
|
{
|
|
"platform": "QFX5100-96S",
|
|
"version_affected": "<",
|
|
"version_name": "17.4",
|
|
"version_value": "17.4R3-S4"
|
|
},
|
|
{
|
|
"platform": "QFX5100-96S",
|
|
"version_affected": "<",
|
|
"version_name": "18.1",
|
|
"version_value": "18.1R3-S10"
|
|
},
|
|
{
|
|
"platform": "QFX5100-96S",
|
|
"version_affected": "<",
|
|
"version_name": "18.2",
|
|
"version_value": "18.2R3-S3"
|
|
},
|
|
{
|
|
"platform": "QFX5100-96S",
|
|
"version_affected": "<",
|
|
"version_name": "18.3",
|
|
"version_value": "18.3R3-S2"
|
|
},
|
|
{
|
|
"platform": "QFX5100-96S",
|
|
"version_affected": "<",
|
|
"version_name": "18.4",
|
|
"version_value": "18.4R2-S4, 18.4R3-S1"
|
|
},
|
|
{
|
|
"platform": "QFX5100-96S",
|
|
"version_affected": "<",
|
|
"version_name": "19.1",
|
|
"version_value": "19.1R3, 19.1R3-S4"
|
|
},
|
|
{
|
|
"platform": "QFX5100-96S",
|
|
"version_affected": "<",
|
|
"version_name": "19.2",
|
|
"version_value": "19.2R2"
|
|
},
|
|
{
|
|
"platform": "QFX5100-96S",
|
|
"version_affected": "<",
|
|
"version_name": "19.3",
|
|
"version_value": "19.3R3"
|
|
},
|
|
{
|
|
"platform": "QFX5100-96S",
|
|
"version_affected": "<",
|
|
"version_name": "19.4",
|
|
"version_value": "19.4R2"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"vendor_name": "Juniper Networks"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"configuration": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "The DDoS feature is enabled by default, there is no specific config stanza required to enable DDoS protection."
|
|
}
|
|
],
|
|
"data_format": "MITRE",
|
|
"data_type": "CVE",
|
|
"data_version": "4.0",
|
|
"description": {
|
|
"description_data": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "Due to an improper Initialization vulnerability on Juniper Networks Junos OS QFX5100-96S devices with QFX 5e Series image installed, ddos-protection configuration changes will not take effect beyond the default DDoS (Distributed Denial of Service) settings when configured from the CLI. The DDoS protection (jddosd) daemon allows the device to continue to function while protecting the packet forwarding engine (PFE) during the DDoS attack. When this issue occurs, the default DDoS settings within the PFE apply, as CPU bound packets will be throttled and dropped in the PFE when the limits are exceeded. To check if the device has this issue, the administrator can execute the following command to monitor the status of DDoS protection: user@device> show ddos-protection protocols error: the ddos-protection subsystem is not running This issue affects only QFX5100-96S devices. No other products or platforms are affected by this issue. This issue affects: Juniper Networks Junos OS on QFX5100-96S: 17.3 versions prior to 17.3R3-S10; 17.4 versions prior to 17.4R3-S4; 18.1 versions prior to 18.1R3-S10; 18.2 versions prior to 18.2R3-S3; 18.3 versions prior to 18.3R3-S2; 18.4 versions prior to 18.4R2-S4, 18.4R3-S1; 19.1 versions prior to 19.1R3, 19.1R3-S4; 19.2 versions prior to 19.2R2; 19.3 versions prior to 19.3R3; 19.4 versions prior to 19.4R2;"
|
|
}
|
|
]
|
|
},
|
|
"exploit": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
|
|
}
|
|
],
|
|
"generator": {
|
|
"engine": "Vulnogram 0.0.9"
|
|
},
|
|
"impact": {
|
|
"cvss": {
|
|
"attackComplexity": "LOW",
|
|
"attackVector": "NETWORK",
|
|
"availabilityImpact": "LOW",
|
|
"baseScore": 5.8,
|
|
"baseSeverity": "MEDIUM",
|
|
"confidentialityImpact": "NONE",
|
|
"integrityImpact": "NONE",
|
|
"privilegesRequired": "NONE",
|
|
"scope": "CHANGED",
|
|
"userInteraction": "NONE",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
|
|
"version": "3.1"
|
|
}
|
|
},
|
|
"problemtype": {
|
|
"problemtype_data": [
|
|
{
|
|
"description": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "Denial of Service (DoS)"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"description": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "CWE-665 Improper Initialization"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"references": {
|
|
"reference_data": [
|
|
{
|
|
"refsource": "MISC",
|
|
"url": "https://kb.juniper.net/JSA11129",
|
|
"name": "https://kb.juniper.net/JSA11129"
|
|
}
|
|
]
|
|
},
|
|
"solution": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "The following software releases have been updated to resolve this specific issue: 17.3R3-S10, 17.4R3-S4, 18.1R3-S10, 18.2R3-S3, 18.3R3-S2, 18.4R2-S4, 18.4R3-S1, 19.1R3, 19.1R3-S4, 19.2R2, 19.3R3, 19.4R2, 20.1R1, and all subsequent releases.\n"
|
|
}
|
|
],
|
|
"source": {
|
|
"advisory": "JSA11129",
|
|
"defect": [
|
|
"1486480"
|
|
],
|
|
"discovery": "USER"
|
|
},
|
|
"work_around": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "The following command can be used to enable ddos-protection manually:\nroot@device% /usr/sbin/jddosd -N &\n"
|
|
}
|
|
]
|
|
} |