Vulnerability CVE-2018-0050 - CERT Civis.Net

Vulnerability Name:

CVE-2018-0050 (CCN-151037)

Assigned:

2017-11-16

Published:

2018-10-10

Updated:

2019-10-09

Summary:

An error handling vulnerability in Routing Protocols Daemon (RPD) of Juniper Networks Junos OS allows an attacker to cause RPD to crash. Continued receipt of this malformed MPLS RSVP packet will cause a sustained Denial of Service condition. Affected releases are Juniper Networks Junos OS: 14.1 versions prior to 14.1R8-S5, 14.1R9; 14.1X53 versions prior to 14.1X53-D48 on QFX Switching; 14.2 versions prior to 14.1X53-D130 on QFabric System; 14.2 versions prior to 14.2R4. This issue does not affect versions of Junos OS before 14.1R1. Junos OS RSVP only supports IPv4. IPv6 is not affected by this issue. This issue require it to be received on an interface configured to receive this type of traffic.

CVSS v3 Severity:

5.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2018-0050

Source: BID
Type: Third Party Advisory
106206

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1041851

Source: XF
Type: UNKNOWN
juniper-junos-cve20180050-dos(151037)

Source: CCN
Type: Juniper Networks Security Bulletin JSA10884
Junos OS: Receipt of a malformed MPLS RSVP packet leads to a Routing Protocols Daemon (RPD) crash (CVE-2018-0050)

Source: CONFIRM
Type: Mitigation, Vendor Advisory
https://kb.juniper.net/JSA10884

Vulnerable Configuration:

Configuration 1:

cpe:/o:juniper:junos:14.1:-:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1:r1:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1:r2:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1:r3:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1:r4:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1:r5:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1:r6:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1:r7:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1:r9:*:*:*:*:*:*

Configuration 2:

cpe:/o:juniper:junos:14.1x53:-:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d10:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d121:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d15:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d16:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d25:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d26:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d27:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d30:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d35:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d40:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d42:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d43:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d44:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d45:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d46:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d47:*:*:*:*:*:*

Configuration 3:

cpe:/o:juniper:junos:14.1x53:-:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d10:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d121:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d15:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d16:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d25:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d26:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d27:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d30:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d35:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d40:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d42:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d43:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d44:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d45:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d46:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d47:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.1x53:d48:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.2:*:*:*:*:*:*:*

Configuration 4:

cpe:/o:juniper:junos:14.2:*:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.2:r1:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.2:r2:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.2:r3:*:*:*:*:*:*

Configuration CCN 1:

cpe:/o:juniper:junos:14.1:-:*:*:*:*:*:*

OR cpe:/o:juniper:junos:14.2:*:*:*:*:*:*:*

Denotes that component is vulnerable