Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2023-00570

Опубликовано: 11 янв. 2023
Источник: fstec
CVSS3: 6.1
CVSS2: 4.6
EPSS Низкий

Описание

Уязвимость модуля Packet Forwarding Engine (PFE) операционных систем Juniper Networks Junos OS Evolved и Junos связана с ошибками синхронизации при использовании общего ресурса. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, вызвать отказ в обслуживании

Вендор

Juniper Networks Inc.

Наименование ПО

Junos OS Evolved

Версия ПО

до 20.4R3-S4-EVO (Junos OS Evolved)
от 21.3 до 21.3R3-S1-EVO (Junos OS Evolved)
от 21.4 до 21.4R2-S2-EVO (Junos OS Evolved)
от 22.1 до 22.1R1-S2-EVO (Junos OS Evolved)
от 22.2 до 22.2R2-EVO (Junos OS Evolved)

Тип ПО

Операционная система

Операционные системы и аппаратные платформы

Juniper Networks Inc. Junos OS Evolved до 20.4R3-S4-EVO
Juniper Networks Inc. Junos OS Evolved от 21.3 до 21.3R3-S1-EVO
Juniper Networks Inc. Junos OS Evolved от 21.4 до 21.4R2-S2-EVO
Juniper Networks Inc. Junos OS Evolved от 22.1 до 22.1R1-S2-EVO
Juniper Networks Inc. Junos OS Evolved от 22.2 до 22.2R2-EVO

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 4,6)
Средний уровень опасности (базовая оценка CVSS 3.0 составляет 6,1)

Возможные меры по устранению уязвимости

Использование рекомендаций производителя:
https://kb.juniper.net/JSA70193

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Ссылки на источники

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 29%
0.00103
Низкий

6.1 Medium

CVSS3

4.6 Medium

CVSS2

Связанные уязвимости

CVSS3: 6.1
nvd
около 3 лет назад

An Allocation of Resources Without Limits or Throttling weakness in the memory management of the Packet Forwarding Engine (PFE) on Juniper Networks Junos OS Evolved PTX10003 Series devices allows an adjacently located attacker who has established certain preconditions and knowledge of the environment to send certain specific genuine packets to begin a Time-of-check Time-of-use (TOCTOU) Race Condition attack which will cause a memory leak to begin. Once this condition begins, and as long as the attacker is able to sustain the offending traffic, a Distributed Denial of Service (DDoS) event occurs. As a DDoS event, the offending packets sent by the attacker will continue to flow from one device to another as long as they are received and processed by any devices, ultimately causing a cascading outage to any vulnerable devices. Devices not vulnerable to the memory leak will process and forward the offending packet(s) to neighboring devices. Due to internal anti-flood security controls and

CVSS3: 6.1
github
около 3 лет назад

An Allocation of Resources Without Limits or Throttling weakness in the memory management of the Packet Forwarding Engine (PFE) on Juniper Networks Junos OS Evolved PTX10003 Series devices allows an adjacently located attacker who has established certain preconditions and knowledge of the environment to send certain specific genuine packets to begin a Time-of-check Time-of-use (TOCTOU) Race Condition attack which will cause a memory leak to begin. Once this condition begins, and as long as the attacker is able to sustain the offending traffic, a Distributed Denial of Service (DDoS) event occurs. As a DDoS event, the offending packets sent by the attacker will continue to flow from one device to another as long as they are received and processed by any devices, ultimately causing a cascading outage to any vulnerable devices. Devices not vulnerable to the memory leak will process and forward the offending packet(s) to neighboring devices. Due to internal anti-flood security controls a...

EPSS

Процентиль: 29%
0.00103
Низкий

6.1 Medium

CVSS3

4.6 Medium

CVSS2