5.9

CVE-2018-0051

Junos OS: Denial of Service vulnerability in MS-PIC, MS-MIC, MS-MPC, MS-DPC and SRX flow daemon (flowd) related to SIP ALG

A Denial of Service vulnerability in the SIP application layer gateway (ALG) component of Junos OS based platforms allows an attacker to crash MS-PIC, MS-MIC, MS-MPC, MS-DPC or SRX flow daemon (flowd) process. This issue affects Junos OS devices with NAT or stateful firewall configuration in combination with the SIP ALG enabled. SIP ALG is enabled by default on SRX Series devices except for SRX-HE devices. SRX-HE devices have SIP ALG disabled by default. The status of ALGs in SRX device can be obtained by executing the command: show security alg status Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77; 12.3X48 versions prior to 12.3X48-D70; 15.1X49 versions prior to 15.1X49-D140; 15.1 versions prior to 15.1R4-S9, 15.1R7-S1; 15.1F6; 16.1 versions prior to 16.1R4-S9, 16.1R6-S1, 16.1R7; 16.2 versions prior to 16.2R2-S7, 16.2R3; 17.1 versions prior to 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S6, 17.2R2-S4, 17.2R3; 17.3 versions prior to 17.3R1-S5, 17.3R2-S2, 17.3R3; 17.4 versions prior to 17.4R2. No other Juniper Networks products or platforms are affected by this issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Juniper ≫ Junos Version 12.1x46
Juniper ≫ Junos Version 12.1x46 Update d10
Juniper ≫ Junos Version 12.1x46 Update d15
Juniper ≫ Junos Version 12.1x46 Update d20
Juniper ≫ Junos Version 12.1x46 Update d25
Juniper ≫ Junos Version 12.1x46 Update d30
Juniper ≫ Junos Version 12.1x46 Update d35
Juniper ≫ Junos Version 12.1x46 Update d40
Juniper ≫ Junos Version 12.1x46 Update d45
Juniper ≫ Junos Version 12.1x46 Update d50
Juniper ≫ Junos Version 12.1x46 Update d55
Juniper ≫ Junos Version 12.1x46 Update d60
Juniper ≫ Junos Version 12.1x46 Update d65
Juniper ≫ Junos Version 12.3x48
Juniper ≫ Junos Version 12.3x48 Update d10
Juniper ≫ Junos Version 12.3x48 Update d15
Juniper ≫ Junos Version 12.3x48 Update d20
Juniper ≫ Junos Version 12.3x48 Update d25
Juniper ≫ Junos Version 12.3x48 Update d30
Juniper ≫ Junos Version 12.3x48 Update d35
Juniper ≫ Junos Version 12.3x48 Update d40
Juniper ≫ Junos Version 12.3x48 Update d45
Juniper ≫ Junos Version 12.3x48 Update d50
Juniper ≫ Junos Version 12.3x48 Update d55
Juniper ≫ Junos Version 12.3x48 Update d60
Juniper ≫ Junos Version 12.3x48 Update d65
Juniper ≫ Junos Version 15.1x49
Juniper ≫ Junos Version 15.1x49 Update d10
Juniper ≫ Junos Version 15.1x49 Update d100
Juniper ≫ Junos Version 15.1x49 Update d110
Juniper ≫ Junos Version 15.1x49 Update d120
Juniper ≫ Junos Version 15.1x49 Update d130
Juniper ≫ Junos Version 15.1x49 Update d20
Juniper ≫ Junos Version 15.1x49 Update d30
Juniper ≫ Junos Version 15.1x49 Update d35
Juniper ≫ Junos Version 15.1x49 Update d40
Juniper ≫ Junos Version 15.1x49 Update d45
Juniper ≫ Junos Version 15.1x49 Update d50
Juniper ≫ Junos Version 15.1x49 Update d55
Juniper ≫ Junos Version 15.1x49 Update d60
Juniper ≫ Junos Version 15.1x49 Update d65
Juniper ≫ Junos Version 15.1x49 Update d75
Juniper ≫ Junos Version 15.1x49 Update d80
Juniper ≫ Junos Version 15.1x49 Update d90
Juniper ≫ Junos Version 15.1
Juniper ≫ Junos Version 15.1 Update f6
Juniper ≫ Junos Version 15.1 Update r1
Juniper ≫ Junos Version 15.1 Update r2
Juniper ≫ Junos Version 15.1 Update r3
Juniper ≫ Junos Version 15.1 Update r7-s1
Juniper ≫ Junos Version 16.1
Juniper ≫ Junos Version 16.1 Update r1
Juniper ≫ Junos Version 16.1 Update r2
Juniper ≫ Junos Version 16.1 Update r3
Juniper ≫ Junos Version 16.1 Update r5
Juniper ≫ Junos Version 16.1 Update r6-s1
Juniper ≫ Junos Version 16.1 Update r7
Juniper ≫ Junos Version 16.2
Juniper ≫ Junos Version 16.2 Update r1
Juniper ≫ Junos Version 16.2 Update r3
Juniper ≫ Junos Version 17.1
Juniper ≫ Junos Version 17.1 Update r1
Juniper ≫ Junos Version 17.1 Update r2
Juniper ≫ Junos Version 17.1 Update r3
Juniper ≫ Junos Version 17.2
Juniper ≫ Junos Version 17.2 Update r1
Juniper ≫ Junos Version 17.2 Update r2-s4
Juniper ≫ Junos Version 17.2 Update r3
Juniper ≫ Junos Version 17.3
Juniper ≫ Junos Version 17.3 Update r2-s2
Juniper ≫ Junos Version 17.3 Update r3
Juniper ≫ Junos Version 17.4
Juniper ≫ Junos Version 17.4 Update r1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.59% 0.725
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.9 2.2 3.6
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P
Juniper 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.securitytracker.com/id/1041852
Third Party Advisory
VDB Entry
https://kb.juniper.net/JSA10885
Vendor Advisory