Vulnerabilities > CVE-2020-1608 - Unspecified vulnerability in Juniper Junos
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
Receipt of a specific MPLS or IPv6 packet on the core facing interface of an MX Series device configured for Broadband Edge (BBE) service may trigger a kernel crash (vmcore), causing the device to reboot. The issue is specific to the processing of packets destined to BBE clients connected to MX Series subscriber management platforms. This issue affects MX Series running Juniper Networks Junos OS: 17.2 versions starting from17.2R2-S6, 17.2R3 and later releases, prior to 17.2R3-S3; 17.3 versions starting from 17.3R2-S4, 17.3R3-S2 and later releases, prior to 17.3R2-S5, 17.3R3-S5; 17.4 versions starting from 17.4R2 and later releases, prior to 17.4R2-S7,17.4R3; 18.1 versions starting from 18.1R2-S3, 18.1R3 and later releases, prior to 18.1R3-S6; 18.2 versions starting from18.2R1-S1, 18.2R2 and later releases, prior to 18.2R3-S2; 18.2X75 versions prior to 18.2X75-D51, 18.2X75-D60; 18.3 versions prior to 18.3R3; 18.4 versions prior to 18.4R2; 19.1 versions prior to 19.1R1-S3, 19.1R2; 19.2 versions prior to 19.2R1-S2, 19.2R2. This issue does not affect Juniper Networks Junos OS versions prior to 17.2R2-S6.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| OS | 66 | |
| Hardware | 16 |
Nessus
NASL family Junos Local Security Checks NASL id JUNIPER_JSA10987.NASL description According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability due to an unspecified issue in the processing of packets destined to Broadband Edge (BBE) clients connected to MX Series subscriber management platforms. Receipt of a specific MPLS or IPv6 packet on the core facing interface of an MX Series device configured for BBE service may trigger a kernel crash (vmcore). An unauthenticated, remote attacker can exploit this to cause the device to reboot. Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-06-01 modified 2020-06-02 plugin id 133145 published 2020-01-21 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/133145 title Junos OS: Broadband Edge Service Denial of Service (DoS) Vulnerability (JSA10987) code # # (C) Tenable Network Security, Inc. # include('compat.inc'); if (description) { script_id(133145); script_version("1.1"); script_cvs_date("Date: 2020/01/21"); script_cve_id("CVE-2020-1608"); script_xref(name:"JSA", value:"JSA10987"); script_xref(name:"IAVA", value:"2020-A-0012"); script_name(english:"Junos OS: Broadband Edge Service Denial of Service (DoS) Vulnerability (JSA10987)"); script_set_attribute(attribute:"synopsis", value: "The remote device is missing a vendor-supplied security patch."); script_set_attribute(attribute:"description", value: "According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability due to an unspecified issue in the processing of packets destined to Broadband Edge (BBE) clients connected to MX Series subscriber management platforms. Receipt of a specific MPLS or IPv6 packet on the core facing interface of an MX Series device configured for BBE service may trigger a kernel crash (vmcore). An unauthenticated, remote attacker can exploit this to cause the device to reboot. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number."); # https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10987 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b3b4a2e3"); script_set_attribute(attribute:"solution", value: "Apply the relevant Junos software release referenced in Juniper advisory JSA10987."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-1608"); script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/08"); script_set_attribute(attribute:"patch_publication_date", value:"2020/01/16"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/01/21"); script_set_attribute(attribute:"plugin_type", value:"combined"); script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos"); script_set_attribute(attribute:"stig_severity", value:"I"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Junos Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("junos_version.nasl"); script_require_keys("Host/Juniper/JUNOS/Version"); exit(0); } include('audit.inc'); include('junos.inc'); include('misc_func.inc'); ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version'); model = get_kb_item_or_exit('Host/Juniper/model'); fixes = make_array(); if ("MX" >!< model) audit(AUDIT_INST_VER_NOT_VULN, 'Junos', ver); // 17.2 versions starting from17.2R2-S6, 17.2R3 and later releases, prior to 17.2R3-S3; if (ver =~ "^17.2R1(?=$|[^0-9])" || ver =~ "^17\.2R2(-S[1-5])?(?=$|[^0-9-])") audit(AUDIT_INST_VER_NOT_VULN, 'Junos', ver); fixes['17.2'] = '17.2R3-S3'; // 17.3 versions starting from 17.3R2-S4, 17.3R3-S2 and later releases, prior to 17.3R2-S5, 17.3R3-S5; if (ver =~ "^17.3R1(?=$|[^0-9])" || ver =~ "^17.3R2(-S[1-3])?(?=$|[^0-9-])" || ver =~ "^17.3R3(-S1)?(?=$|[^0-9-])") audit(AUDIT_INST_VER_NOT_VULN, 'Junos', ver); else if (ver =~ "^17.3R2(?=$|[^0-9])") fixes['17.3'] = '17.3R2-S5'; else fixes['17.3'] = '17.3R3-S5'; // 17.4 versions starting from 17.4R2 and later releases, prior to 17.4R2-S7,17.4R3; if (ver =~ "^17.4R1(?=$|[^0-9])") audit(AUDIT_INST_VER_NOT_VULN, 'Junos', ver); fixes['17.4'] = '17.4R2-S7'; // 18.1 versions starting from 18.1R2-S3, 18.1R3 and later releases, prior to 18.1R3-S6; if (ver =~ "^18.1R1(?=$|[^0-9])" || ver =~ "^18.1R2(-S[12])?(?=$|[^0-9-])") audit(AUDIT_INST_VER_NOT_VULN, 'Junos', ver); fixes['18.1'] = '18.1R3-S6'; // 18.2 versions starting from18.2R1-S1, 18.2R2 and later releases, prior to 18.2R3-S2; if (ver =~ "^18.2R1$") audit(AUDIT_INST_VER_NOT_VULN, 'Junos', ver); fixes['18.2'] = '18.2R3-S2'; // 18.2X75 versions prior to 18.2X75-D51, 18.2X75-D60; fixes['18.2X75'] = '18.2X75-D51'; fixes['18.3'] = '18.3R3'; fixes['18.4'] = '18.4R2'; fixes['19.1'] = '19.1R1-S3'; fixes['19.2'] = '19.2R1-S2'; fix = check_junos(ver:ver, fixes:fixes, exit_on_fail:TRUE); report = get_report(ver:ver, fix:fix); security_report_v4(severity:SECURITY_HOLE, port:0, extra:report);NASL family Junos Local Security Checks NASL id JUNIPER_JSA10979.NASL description The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the JSA10979 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-05-06 modified 2020-02-25 plugin id 133965 published 2020-02-25 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/133965 title Juniper JSA10979 code # # (C) Tenable Network Security, Inc. # include('compat.inc'); if (description) { script_id(133965); script_version("1.2"); script_cve_id( "CVE-2020-1600", "CVE-2020-1601", "CVE-2020-1602", "CVE-2020-1603", "CVE-2020-1604", "CVE-2020-1605", "CVE-2020-1607", "CVE-2020-1608", "CVE-2020-1609" ); script_xref(name:"IAVA", value:"2020-A-0012"); script_name(english:"Juniper JSA10979"); script_summary(english:"Checks the Junos version and build date."); script_set_attribute(attribute:"synopsis", value: "The remote device is missing a vendor-supplied security patch."); script_set_attribute(attribute:"description", value: "The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the JSA10979 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version number."); script_set_attribute(attribute:"see_also", value:"https://kb.juniper.net/KB16613"); script_set_attribute(attribute:"see_also", value:"https://kb.juniper.net/KB16765"); script_set_attribute(attribute:"see_also", value:"https://kb.juniper.net/KB16446"); script_set_attribute(attribute:"see_also", value:"https://kb.juniper.net/JSA10979"); script_set_attribute(attribute:"solution", value: "Apply the relevant Junos software release referenced in Juniper advisory JSA10979"); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-1600"); script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/08"); script_set_attribute(attribute:"patch_publication_date", value:"2020/01/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/25"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/05"); script_set_attribute(attribute:"plugin_type", value:"combined"); script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos"); script_set_attribute(attribute:"stig_severity", value:"I"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Junos Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("junos_version.nasl"); script_require_keys("Host/Juniper/JUNOS/Version", "Host/Juniper/model"); exit(0); } include('audit.inc'); include('junos.inc'); include('misc_func.inc'); ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version'); model = get_kb_item_or_exit('Host/Juniper/model'); fixes = make_array(); fixes["12.3X48"] = "12.3X48-D90"; fixes["15.1"] = "15.1R7-S6"; fixes["15.1X49"] = "15.1X49-D200"; fixes["15.1X53"] = "15.1X53-D238"; fixes["16.1"] = "16.1R7-S5"; fixes["16.2"] = "16.2R2-S11"; fixes["17.1"] = "17.1R3-S1"; fixes["17.2"] = "17.2R3-S2"; fixes["17.3"] = "17.3R3-S7"; fixes["17.4"] = "17.4R2-S4"; fixes["18.1"] = "18.1R3-S5"; fixes["18.2"] = "18.2R3"; fixes["18.2X75"] = "18.2X75-D50"; fixes["18.3"] = "18.3R2"; fixes["18.4"] = "18.4R1-S6"; fixes["19.1"] = "19.1R2"; fix = check_junos(ver:ver, fixes:fixes, exit_on_fail:TRUE); report = get_report(ver:ver, fix:fix); security_report_v4(severity:SECURITY_WARNING, port:0, extra:report);