7.5

CVE-2018-0051

A Denial of Service vulnerability in the SIP application layer gateway (ALG) component of Junos OS based platforms allows an attacker to crash MS-PIC, MS-MIC, MS-MPC, MS-DPC or SRX flow daemon (flowd) process. This issue affects Junos OS devices with NAT or stateful firewall configuration in combination with the SIP ALG enabled. SIP ALG is enabled by default on SRX Series devices except for SRX-HE devices. SRX-HE devices have SIP ALG disabled by default. The status of ALGs in SRX device can be obtained by executing the command: show security alg status Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77; 12.3X48 versions prior to 12.3X48-D70; 15.1X49 versions prior to 15.1X49-D140; 15.1 versions prior to 15.1R4-S9, 15.1R7-S1; 15.1F6; 16.1 versions prior to 16.1R4-S9, 16.1R6-S1, 16.1R7; 16.2 versions prior to 16.2R2-S7, 16.2R3; 17.1 versions prior to 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S6, 17.2R2-S4, 17.2R3; 17.3 versions prior to 17.3R1-S5, 17.3R2-S2, 17.3R3; 17.4 versions prior to 17.4R2. No other Juniper Networks products or platforms are affected by this issue.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Juniper ≫ Junos Version12.1x46
Juniper ≫ Junos Version12.1x46 Updated10
Juniper ≫ Junos Version12.1x46 Updated15
Juniper ≫ Junos Version12.1x46 Updated20
Juniper ≫ Junos Version12.1x46 Updated25
Juniper ≫ Junos Version12.1x46 Updated30
Juniper ≫ Junos Version12.1x46 Updated35
Juniper ≫ Junos Version12.1x46 Updated40
Juniper ≫ Junos Version12.1x46 Updated45
Juniper ≫ Junos Version12.1x46 Updated50
Juniper ≫ Junos Version12.1x46 Updated55
Juniper ≫ Junos Version12.1x46 Updated60
Juniper ≫ Junos Version12.1x46 Updated65
Juniper ≫ Junos Version12.3x48
Juniper ≫ Junos Version12.3x48 Updated10
Juniper ≫ Junos Version12.3x48 Updated15
Juniper ≫ Junos Version12.3x48 Updated20
Juniper ≫ Junos Version12.3x48 Updated25
Juniper ≫ Junos Version12.3x48 Updated30
Juniper ≫ Junos Version12.3x48 Updated35
Juniper ≫ Junos Version12.3x48 Updated40
Juniper ≫ Junos Version12.3x48 Updated45
Juniper ≫ Junos Version12.3x48 Updated50
Juniper ≫ Junos Version12.3x48 Updated55
Juniper ≫ Junos Version12.3x48 Updated60
Juniper ≫ Junos Version12.3x48 Updated65
Juniper ≫ Junos Version15.1x49
Juniper ≫ Junos Version15.1x49 Updated10
Juniper ≫ Junos Version15.1x49 Updated100
Juniper ≫ Junos Version15.1x49 Updated110
Juniper ≫ Junos Version15.1x49 Updated120
Juniper ≫ Junos Version15.1x49 Updated130
Juniper ≫ Junos Version15.1x49 Updated20
Juniper ≫ Junos Version15.1x49 Updated30
Juniper ≫ Junos Version15.1x49 Updated35
Juniper ≫ Junos Version15.1x49 Updated40
Juniper ≫ Junos Version15.1x49 Updated45
Juniper ≫ Junos Version15.1x49 Updated50
Juniper ≫ Junos Version15.1x49 Updated55
Juniper ≫ Junos Version15.1x49 Updated60
Juniper ≫ Junos Version15.1x49 Updated65
Juniper ≫ Junos Version15.1x49 Updated75
Juniper ≫ Junos Version15.1x49 Updated80
Juniper ≫ Junos Version15.1x49 Updated90
Juniper ≫ Junos Version15.1
Juniper ≫ Junos Version15.1 Updatef6
Juniper ≫ Junos Version15.1 Updater1
Juniper ≫ Junos Version15.1 Updater2
Juniper ≫ Junos Version15.1 Updater3
Juniper ≫ Junos Version15.1 Updater7-s1
Juniper ≫ Junos Version16.1
Juniper ≫ Junos Version16.1 Updater1
Juniper ≫ Junos Version16.1 Updater2
Juniper ≫ Junos Version16.1 Updater3
Juniper ≫ Junos Version16.1 Updater5
Juniper ≫ Junos Version16.1 Updater6-s1
Juniper ≫ Junos Version16.1 Updater7
Juniper ≫ Junos Version16.2
Juniper ≫ Junos Version16.2 Updater1
Juniper ≫ Junos Version16.2 Updater3
Juniper ≫ Junos Version17.1
Juniper ≫ Junos Version17.1 Updater1
Juniper ≫ Junos Version17.1 Updater2
Juniper ≫ Junos Version17.1 Updater3
Juniper ≫ Junos Version17.2
Juniper ≫ Junos Version17.2 Updater1
Juniper ≫ Junos Version17.2 Updater2-s4
Juniper ≫ Junos Version17.2 Updater3
Juniper ≫ Junos Version17.3
Juniper ≫ Junos Version17.3 Updater2-s2
Juniper ≫ Junos Version17.3 Updater3
Juniper ≫ Junos Version17.4
Juniper ≫ Junos Version17.4 Updater1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.41% 0.581
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.9 2.2 3.6
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P
sirt@juniper.net 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.securitytracker.com/id/1041852
Third Party Advisory
VDB Entry