CVE-2024-39553

Опубликовано: 11 июл. 2024

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

This issue only happens when inline jflow is configured.

This does not impact any forwarding traffic. The impacted services MSVCS-DB app crashes momentarily and recovers by itself.

This issue affects Juniper Networks Junos OS Evolved:

21.4 versions earlier than 21.4R3-S7-EVO;
22.2 versions earlier than 22.2R3-S3-EVO;
22.3 versions earlier than 22.3R3-S2-EVO;
22.4 versions earlier than 22.4R3-EVO;
23.2 versions earlier than 23.2R1-S2-EVO, 23.2R2-EVO.

Ссылки

https://supportportal.juniper.net/JSA79101
Vendor Advisory
Exploit
https://supportportal.juniper.net/JSA79101
Vendor Advisory
Exploit

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:juniper:junos_os_evolved:21.4:-:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:21.4:r1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:21.4:r1-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:21.4:r1-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:21.4:r2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:21.4:r2-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:21.4:r2-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:21.4:r3:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s3:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s4:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s5:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s6:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.2:-:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.2:r1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.2:r1-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.2:r1-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.2:r2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.2:r2-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.2:r2-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.2:r3:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.2:r3-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.2:r3-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.3:-:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.3:r1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.3:r1-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.3:r1-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.3:r2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.3:r2-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.3:r2-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.3:r3:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.3:r3-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.4:-:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.4:r1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.4:r1-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.4:r1-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.4:r2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.4:r2-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:22.4:r2-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:23.2:-:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:23.2:r1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos_os_evolved:23.2:r2:*:*:*:*:*:*

EPSS

Процентиль: 34%

0.00141

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-668

Связанные уязвимости

GHSA-48wm-jcwq-6m89

CVSS3: 6.5

github

больше 1 года назад

An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to send arbitrary data to the device, which leads msvcsd process to crash with limited availability impacting Denial of Service (DoS) and allows unauthorized network access to the device, potentially impacting system integrity. This issue only happens when inline jflow is configured. This does not impact any forwarding traffic. The impacted services MSVCS-DB app crashes momentarily and recovers by itself. This issue affects Juniper Networks Junos OS Evolved: * 21.4 versions earlier than 21.4R3-S7-EVO; * 22.2 versions earlier than 22.2R3-S3-EVO; * 22.3 versions earlier than 22.3R3-S2-EVO; * 22.4 versions earlier than 22.4R3-EVO; * 23.2 versions earlier than 23.2R1-S2-EVO, 23.2R2-EVO.

BDU:2025-03717

CVSS3: 6.5

fstec

больше 1 года назад

Уязвимость службы выборки операционных систем Juniper Networks Junos OS Evolved, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 34%

0.00141

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-668