CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2017-10622 – Junos Space: Authentication bypass vulnerability
https://notcve.org/view.php?id=CVE-2017-10622
An authentication bypass vulnerability in Juniper Networks Junos Space Network Management Platform may allow a remote unauthenticated network based attacker to login as any privileged user. This issue only affects Junos Space Network Management Platform 17.1R1 without Patch v1 and 16.1 releases prior to 16.1R3. This issue was found by an external security researcher. Una vulnerabilidad de omisión de autenticación en Juniper Networks Junos Space Network Management Platform puede permitir a un atacante remoto no autenticado en la red iniciar sesión como cualquier usuario privilegiado. Este problema solo afecta a Junos Space Network Management Platform 17.1R1 sin Patch v1 y las distribuciones 16.1 anteriores a la 16.1R3. • http://www.securityfocus.com/bid/101258 https://kb.juniper.net/JSA10824 • CWE-287: Improper Authentication •
CVSS: 5.3EPSS: 0%CPEs: 10EXPL: 0CVE-2017-10621 – Junos OS: Denial of service vulnerability in telnetd
https://notcve.org/view.php?id=CVE-2017-10621
A denial of service vulnerability in telnetd service on Juniper Networks Junos OS allows remote unauthenticated attackers to cause a denial of service. Affected Junos OS releases are: 12.1X46 prior to 12.1X46-D71; 12.3X48 prior to 12.3X48-D50; 14.1 prior to 14.1R8-S5, 14.1R9; 14.1X53 prior to 14.1X53-D50; 14.2 prior to 14.2R7-S9, 14.2R8; 15.1 prior to 15.1F2-S16, 15.1F5-S7, 15.1F6-S6, 15.1R5-S2, 15.1R6; 15.1X49 prior to 15.1X49-D90; 15.1X53 prior to 15.1X53-D47; 16.1 prior to 16.1R4-S1, 16.1R5; 16.2 prior to 16.2R1-S3, 16.2R2; Una vulnerabilidad de denegación de servicio (DoS) en el servicio telnetd en Juniper Networks Junos OS permite que atacantes remotos no autenticados provoquen una denegación de servicio (DoS). Las distribuciones afectadas Junos OS son: 12.1X46 anteriores a 12.1X46-D71; 12.3X48 anteriores a 12.3X48-D50; 14.1 anteriores a 14.1R8-S5, 14.1R9; 14.1X53 anteriores a 14.1X53-D50; 14.2 anteriores a 14.2R7-S9, 14.2R8; 15.1 anteriores a 15.1F2-S16, 15.1F5-S7, 15.1F6-S6, 15.1R5-S2, 15.1R6; 15.1X49 anteriores a 15.1X49-D90; 15.1X53 anteriores a 15.1X53-D47; 16.1 anteriores a 16.1R4-S1, 16.1R5; 16.2 anteriores a 16.2R1-S3, 16.2R2; • https://kb.juniper.net/JSA10817 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.9EPSS: 0%CPEs: 114EXPL: 0CVE-2017-10618 – Junos: RPD core due to BGP UPDATE with malformed optional transitive attributes
https://notcve.org/view.php?id=CVE-2017-10618
When the 'bgp-error-tolerance' feature â€" designed to help mitigate remote session resets from malformed path attributes â€" is enabled, a BGP UPDATE containing a specifically crafted set of transitive attributes can cause the RPD routing process to crash and restart. Devices with BGP enabled that do not have 'bgp-error-tolerance' configured are not vulnerable to this issue. Affected releases are Juniper Networks Junos OS 13.3 prior to 13.3R10-S2; 14.1 prior to 14.1R8-S4, 14.1R9; 14.1X50 prior to 14.1X50-D185; 14.1X53 prior to 14.1X53-D45, 14.1X53-D50; 14.2 prior to 14.2R7-S7, 14.2R8; 15.1 prior to 15.1F5-S8, 15.1F6-S7, 15.1R5-S6, 15.1R6-S2, 15.1R7; 15.1X49 prior to 15.1X49-D100; 15.1X53 prior to 15.1X53-D64, 15.1X53-D70; 16.1 prior to 16.1R3-S4, 16.1R4-S3, 16.1R5; 16.2 prior to 16.2R1-S5, 16.2R2; 17.1 prior to 17.1R1-S3, 17.1R2; 17.2 prior to 17.2R1-S2, 17.2R2; 17.2X75 prior to 17.2X75-D50. No other Juniper Networks products or platforms are affected by this issue. Cuando 'bgp-error-tolerance' feature #xe2;#x80;", que está diseñado para ayudar a mitigar reinicios de sesiones remotas de atributos de ruta mal formados #xe2;#x80, está habilitado, un BGP UPDATE que contenga una serie de atributos transitivos especialmente manipulados podría provocar que el proceso de enrutamiento de RPD se cierre de manera inesperada y se reinicie. • https://kb.juniper.net/JSA10820 https://www.juniper.net/documentation/en_US/junos/topics/concept/bgp-error-handling-overview.html https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/bgp-error-tolerance.html •
CVSS: 5.5EPSS: 0%CPEs: 72EXPL: 0CVE-2017-10613 – Junos OS: A kernel hang may occur due to a specific loopback filter action command
https://notcve.org/view.php?id=CVE-2017-10613
A vulnerability in a specific loopback filter action command, processed in a specific logical order of operation, in a running configuration of Juniper Networks Junos OS, allows an attacker with CLI access and the ability to initiate remote sessions to the loopback interface with the defined action, to hang the kernel. Affected releases are Juniper Networks Junos OS 12.1X46 prior to 12.1X46-D55; 12.3X48 prior to 12.3X48-D35; 14.1 prior to 14.1R8-S4, 14.1R9; 14.1X53 prior to 14.1X53-D40; 14.2 prior to 14.2R4-S9, 14.2R7-S8, 14.2R8; 15.1 prior to 15.1F5-S3, 15.1F6, 15.1R4; 15.1X49 prior to 15.1X49-D60; 15.1X53 prior to 15.1X53-D47; 16.1 prior to 16.1R2. No other Juniper Networks products or platforms are affected by this issue. Una vulnerabilidad en un comando de acción de filtro de loopback específico, procesado en un orden lógico específico de operación, en un configuración activa en Juniper Networks Junos OS, permite que un atacante con acceso CLI y la capacidad para iniciar sesiones remotas a la interfaz loopback con la acción definida cuelgue el kernel. Las distribuciones afectadas son: Juniper Networks Junos OS 12.1X46 anteriores a 12.1X46-D55; 12.3X48 anteriores a 12.3X48-D35; 14.1 anteriores a 14.1R8-S4, 14.1R9; 14.1X53 anteriores a 14.1X53-D40; 14.2 anteriores a 14.2R4-S9, 14.2R7-S8, 14.2R8; 15.1 anteriores a 15.1F5-S3, 15.1F6, 15.1R4; 15.1X49 anteriores a 15.1X49-D60; 15.1X53 anteriores a 15.1X53-D47; 16.1 anteriores a 16.1R2. • https://kb.juniper.net/JSA10816 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 0%CPEs: 174EXPL: 0CVE-2017-10611 – Junos: EX Series PFE and MX MPC7E/8E/9E PFE crash when fetching interface stats with 'extended-statistics' enabled
https://notcve.org/view.php?id=CVE-2017-10611
If extended statistics are enabled via 'set chassis extended-statistics', when executing any operation that fetches interface statistics, including but not limited to SNMP GET requests, the pfem process or the FPC may crash and restart. Repeated crashes of PFE processing can result in an extended denial of service condition. This issue only affects the following platforms: (1) EX2200, EX3300, XRE200 (2) MX Series routers with MPC7E/8E/9E PFEs installed, and only if 'extended-statistics' are enabled under the [edit chassis] configuration. Affected releases are Juniper Networks Junos OS 14.1 prior to 14.1R8-S5, 14.1R9 on MX Series; 14.1X53 prior to 14.1X53-D46, 14.1X53-D50 on EX2200, EX3300, XRE200; 14.2 prior to 14.2R7-S9, 14.2R8 on MX Series; 15.1 prior to 15.1F5-S8, 15.1F6-S8, 15.1R5-S3, 15.1R6 on MX Series; 16.1 prior to 16.1R4-S5, 16.1R5, 16.1R6 on MX Series; 16.1X65 prior to 16.1X65-D45 on EX2200, EX3300, XRE200; 16.2 prior to 16.2R2-S1, 16.2R3 on MX Series; 17.1 prior to 17.1R2-S2, 17.1R3 on MX Series; 17.2 prior to 17.2R1-S3, 17.2R2 on MX Series; 17.2X75 prior to 17.2X75-D50 on MX Series; 17.3 prior to 17.3R1-S1, 17.3R2 on MX Series. No other Juniper Networks products or platforms are affected by this issue. • https://kb.juniper.net/JSA10814 •