Vulnerability CVE-2020-1651 - CERT Civis.Net

Vulnerability Name:

CVE-2020-1651 (CCN-184763)

Assigned:

2019-11-04

Published:

2020-07-08

Updated:

2021-10-19

Summary:

On Juniper Networks MX series, receipt of a stream of specific Layer 2 frames may cause a memory leak resulting in the packet forwarding engine (PFE) on the line card to crash and restart, causing traffic interruption. By continuously sending this stream of specific layer 2 frame, an attacker connected to the same broadcast domain can repeatedly crash the PFE, causing a prolonged Denial of Service (DoS). This issue affects Juniper Networks Junos OS on MX Series: 17.2 versions prior to 17.2R3-S4; 17.2X75 versions prior to 17.2X75-D105.19; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R1-S3, 17.4R2; 18.1 versions prior to 18.1R2. This issue does not affect Juniper Networks Junos OS releases prior to 17.2R1.

CVSS v3 Severity:

6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Adjacent Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

3.3 Low (CVSS v2 Vector: AV:A/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Adjacent_Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2020-1651

Source: XF
Type: UNKNOWN
juniper-cve20201651-dos(184763)

Source: CCN
Type: Juniper Networks Security Bulletin JSA11038
Junos OS: MX Series: PFE on the line card may crash due to memory leak. (CVE-2020-1651)

Source: CONFIRM
Type: Vendor Advisory
https://kb.juniper.net/JSA11038

Vulnerable Configuration:

Configuration 1:

cpe:/o:juniper:junos:17.2:-:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2:r1:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2:r1-s1:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2:r1-s2:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2:r1-s3:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2:r1-s4:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2:r1-s5:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2:r1-s7:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2:r1-s8:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2:r2:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2:r2-s11:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2:r2-s6:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2:r2-s7:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2:r3-s1:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2:r3-s2:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2:r3-s3:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2x75:-:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2x75:d102:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2x75:d50:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2x75:d70:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2x75:d92:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.3:-:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.3:r1-s1:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.3:r2:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.3:r2-s1:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.3:r2-s2:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.3:r2-s3:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.3:r2-s4:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.3:r3:-:*:*:*:*:*

OR cpe:/o:juniper:junos:17.3:r3-s1:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.3:r3-s2:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.3:r3-s3:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.3:r3-s4:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.4:-:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.4:r1:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.4:r1-s1:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.4:r1-s2:*:*:*:*:*:*

OR cpe:/o:juniper:junos:18.1:-:*:*:*:*:*:*

OR cpe:/o:juniper:junos:18.1:r1:*:*:*:*:*:*

AND

cpe:/h:juniper:mx10:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:mx10000:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:mx10003:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:mx104:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:mx150:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:mx2008:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:mx2010:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:mx2020:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:mx204:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:mx240:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:mx40:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:mx480:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:mx5:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:mx80:-:*:*:*:*:*:*:*

OR cpe:/h:juniper:mx960:-:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/o:juniper:junos:17.2:-:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.2x75:*:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.3:-:*:*:*:*:*:*

OR cpe:/a:juniper:junos:18.1:-:*:*:*:*:*:*

OR cpe:/o:juniper:junos:17.4:-:*:*:*:*:*:*

Denotes that component is vulnerable