cnvd - cnvd-2020-13881

cnvd-2020-13881

Vulnerability from cnvd

Title: Juniper Networks Junos OS IP firewall filter访问控制错误漏洞

Description:

Juniper Networks Junos OS是一套专用于该公司的硬件设备的网络操作系统。

Juniper Networks Junos OS IP firewall filter存在安全漏洞，远程攻击者可以利用漏洞提交特殊的请求，可绕过安全限制，未授权访问。

Severity: 中

Patch Name: Juniper Networks Junos OS IP firewall filter访问控制错误漏洞的补丁

Patch Description:

Juniper Networks Junos OS是一套专用于该公司的硬件设备的网络操作系统。

Juniper Networks Junos OS IP firewall filter存在安全漏洞，远程攻击者可以利用漏洞提交特殊的请求，可绕过安全限制，未授权访问。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10983

Reference: https://nvd.nist.gov/vuln/detail/CVE-2020-1604

Impacted products

Name
['Juniper Networks Junos OS 16.1', 'Juniper Networks Junos OS 14.1X53', 'Juniper Networks Junos OS 17.3', 'Juniper Networks Junos OS 18.2', 'Juniper Networks Junos OS 17.1', 'Juniper Networks Junos OS 17.2', 'Juniper Networks Junos OS 17.4', 'Juniper Networks Junos OS 18.1', 'Juniper Networks Junos OS 15.1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-1604",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-1604"
    }
  },
  "description": "Juniper Networks Junos OS\u662f\u4e00\u5957\u4e13\u7528\u4e8e\u8be5\u516c\u53f8\u7684\u786c\u4ef6\u8bbe\u5907\u7684\u7f51\u7edc\u64cd\u4f5c\u7cfb\u7edf\u3002\n\nJuniper Networks Junos OS  IP firewall filter\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6f0f\u6d1e\u63d0\u4ea4\u7279\u6b8a\u7684\u8bf7\u6c42\uff0c\u53ef\u7ed5\u8fc7\u5b89\u5168\u9650\u5236\uff0c\u672a\u6388\u6743\u8bbf\u95ee\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10983",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-13881",
  "openTime": "2020-02-27",
  "patchDescription": "Juniper Networks Junos OS\u662f\u4e00\u5957\u4e13\u7528\u4e8e\u8be5\u516c\u53f8\u7684\u786c\u4ef6\u8bbe\u5907\u7684\u7f51\u7edc\u64cd\u4f5c\u7cfb\u7edf\u3002\r\n\r\nJuniper Networks Junos OS  IP firewall filter\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6f0f\u6d1e\u63d0\u4ea4\u7279\u6b8a\u7684\u8bf7\u6c42\uff0c\u53ef\u7ed5\u8fc7\u5b89\u5168\u9650\u5236\uff0c\u672a\u6388\u6743\u8bbf\u95ee\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Juniper Networks Junos OS  IP firewall filter\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Juniper Networks Junos OS 16.1",
      "Juniper Networks Junos OS 14.1X53",
      "Juniper Networks Junos OS 17.3",
      "Juniper Networks Junos OS 18.2",
      "Juniper Networks Junos OS  17.1",
      "Juniper Networks Junos OS  17.2",
      "Juniper Networks Junos OS  17.4",
      "Juniper Networks Junos OS  18.1",
      "Juniper Networks Junos OS  15.1"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-1604",
  "serverity": "\u4e2d",
  "submitTime": "2020-01-15",
  "title": "Juniper Networks Junos OS  IP firewall filter\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e"
}

CVE-2020-1604 (GCVE-0-2020-1604)

Vulnerability from cvelistv5

Published

2020-01-15 08:40

Modified

2024-09-16 16:43

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-284 - Improper Access Control

Summary

On EX4300, EX4600, QFX3500, and QFX5100 Series, a vulnerability in the IP firewall filter component may cause the firewall filter evaluation of certain packets to fail. This issue only affects firewall filter evaluation of certain packets destined to the device Routing Engine (RE). This issue does not affect the Layer 2 firewall filter evaluation nor does it affect the Layer 3 firewall filter evaluation destined to connected hosts. This issue may occur when evaluating both IPv4 or IPv6 packets. This issue affects Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D12 on QFX5100 Series and EX4600 Series; 14.1X53 versions prior to 14.1X53-D52 on QFX3500 Series; 14.1X53 versions prior to 14.1X53-D48 on EX4300 Series; 15.1 versions prior to 15.1R7-S3 on EX4300 Series; 16.1 versions prior to 16.1R7 on EX4300 Series; 17.1 versions prior to 17.1R3 on EX4300 Series; 17.2 versions prior to 17.2R3 on EX4300 Series; 17.3 versions prior to 17.3R2-S5, 17.3R3 on EX4300 Series; 17.4 versions prior to 17.4R2 on EX4300 Series; 18.1 versions prior to 18.1R3 on EX4300 Series; 18.2 versions prior to 18.2R2 on EX4300 Series.

References

▼	URL	Tags
	https://kb.juniper.net/JSA10983	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

▼

Juniper Networks

Junos OS

Version: 14.1X53 < 14.1X53-D12

	Juniper Networks	Junos OS	Version: 14.1X53 < 14.1X53-D52
	Juniper Networks	Junos OS	Version: 14.1X53 < 14.1X53-D48 Version: 15.1 < 15.1R7-S3 Version: 16.1 < 16.1R7 Version: 17.1 < 17.1R3 Version: 17.2 < 17.2R3 Version: 17.3 < 17.3R2-S5, 17.3R3 Version: 17.4 < 17.4R2 Version: 18.1 < 18.1R3 Version: 18.2 < 18.2R2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T06:39:10.842Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kb.juniper.net/JSA10983"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "QFX5100 Series and EX4600 Series"
          ],
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "14.1X53-D12",
              "status": "affected",
              "version": "14.1X53",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "QFX3500 Series"
          ],
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "14.1X53-D52",
              "status": "affected",
              "version": "14.1X53",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "EX4300 Series"
          ],
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "14.1X53-D48",
              "status": "affected",
              "version": "14.1X53",
              "versionType": "custom"
            },
            {
              "lessThan": "15.1R7-S3",
              "status": "affected",
              "version": "15.1",
              "versionType": "custom"
            },
            {
              "lessThan": "16.1R7",
              "status": "affected",
              "version": "16.1",
              "versionType": "custom"
            },
            {
              "lessThan": "17.1R3",
              "status": "affected",
              "version": "17.1",
              "versionType": "custom"
            },
            {
              "lessThan": "17.2R3",
              "status": "affected",
              "version": "17.2",
              "versionType": "custom"
            },
            {
              "lessThan": "17.3R2-S5, 17.3R3",
              "status": "affected",
              "version": "17.3",
              "versionType": "custom"
            },
            {
              "lessThan": "17.4R2",
              "status": "affected",
              "version": "17.4",
              "versionType": "custom"
            },
            {
              "lessThan": "18.1R3",
              "status": "affected",
              "version": "18.1",
              "versionType": "custom"
            },
            {
              "lessThan": "18.2R2",
              "status": "affected",
              "version": "18.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "This issue affects Junos OS device with stateless IPv4 or IPv6 firewall filter configured:\n  [firewall family inet filter]\n  [firewall family inet6 filter]"
        }
      ],
      "datePublic": "2020-01-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "On EX4300, EX4600, QFX3500, and QFX5100 Series, a vulnerability in the IP firewall filter component may cause the firewall filter evaluation of certain packets to fail. This issue only affects firewall filter evaluation of certain packets destined to the device Routing Engine (RE). This issue does not affect the Layer 2 firewall filter evaluation nor does it affect the Layer 3 firewall filter evaluation destined to connected hosts. This issue may occur when evaluating both IPv4 or IPv6 packets. This issue affects Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D12 on QFX5100 Series and EX4600 Series; 14.1X53 versions prior to 14.1X53-D52 on QFX3500 Series; 14.1X53 versions prior to 14.1X53-D48 on EX4300 Series; 15.1 versions prior to 15.1R7-S3 on EX4300 Series; 16.1 versions prior to 16.1R7 on EX4300 Series; 17.1 versions prior to 17.1R3 on EX4300 Series; 17.2 versions prior to 17.2R3 on EX4300 Series; 17.3 versions prior to 17.3R2-S5, 17.3R3 on EX4300 Series; 17.4 versions prior to 17.4R2 on EX4300 Series; 18.1 versions prior to 18.1R3 on EX4300 Series; 18.2 versions prior to 18.2R2 on EX4300 Series."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-15T08:40:35",
        "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "shortName": "juniper"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kb.juniper.net/JSA10983"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "For QFX5100 Series and EX4600 Series:\nThe following software releases have been updated to resolve this specific issue: 14.1X53-D12 and all subsequent releases.\n\nFor QFX3500 Series:\nThe following software releases have been updated to resolve this specific issue: 14.1X53-D52 and all subsequent releases.\n\nFor EX4300 Series: \nThe following software releases have been updated to resolve this specific issue: 14.1X53-D48, 15.1R7-S3, 16.1R7, 17.1R3, 17.2R3, 17.3R2-S5, 17.3R3, 17.4R2, 18.1R3, 18.2R2, 18.3R1 and all subsequent releases."
        }
      ],
      "source": {
        "advisory": "JSA10983",
        "defect": [
          "1026708",
          "1458027",
          "1343402",
          "1377189"
        ],
        "discovery": "USER"
      },
      "title": "Junos OS: EX4300/EX4600/QFX3500/QFX5100 Series: Stateless IP firewall filter may fail to evaluate certain packets",
      "workarounds": [
        {
          "lang": "en",
          "value": "There are no known workarounds for this issue."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "sirt@juniper.net",
          "DATE_PUBLIC": "2020-01-08T17:00:00.000Z",
          "ID": "CVE-2020-1604",
          "STATE": "PUBLIC",
          "TITLE": "Junos OS: EX4300/EX4600/QFX3500/QFX5100 Series: Stateless IP firewall filter may fail to evaluate certain packets"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Junos OS",
                      "version": {
                        "version_data": [
                          {
                            "platform": "QFX5100 Series and EX4600 Series",
                            "version_affected": "\u003c",
                            "version_name": "14.1X53",
                            "version_value": "14.1X53-D12"
                          },
                          {
                            "platform": "QFX3500 Series",
                            "version_affected": "\u003c",
                            "version_name": "14.1X53",
                            "version_value": "14.1X53-D52"
                          },
                          {
                            "platform": "EX4300 Series",
                            "version_affected": "\u003c",
                            "version_name": "14.1X53",
                            "version_value": "14.1X53-D48"
                          },
                          {
                            "platform": "EX4300 Series",
                            "version_affected": "\u003c",
                            "version_name": "15.1",
                            "version_value": "15.1R7-S3"
                          },
                          {
                            "platform": "EX4300 Series",
                            "version_affected": "\u003c",
                            "version_name": "16.1",
                            "version_value": "16.1R7"
                          },
                          {
                            "platform": "EX4300 Series",
                            "version_affected": "\u003c",
                            "version_name": "17.1",
                            "version_value": "17.1R3"
                          },
                          {
                            "platform": "EX4300 Series",
                            "version_affected": "\u003c",
                            "version_name": "17.2",
                            "version_value": "17.2R3"
                          },
                          {
                            "platform": "EX4300 Series",
                            "version_affected": "\u003c",
                            "version_name": "17.3",
                            "version_value": "17.3R2-S5, 17.3R3"
                          },
                          {
                            "platform": "EX4300 Series",
                            "version_affected": "\u003c",
                            "version_name": "17.4",
                            "version_value": "17.4R2"
                          },
                          {
                            "platform": "EX4300 Series",
                            "version_affected": "\u003c",
                            "version_name": "18.1",
                            "version_value": "18.1R3"
                          },
                          {
                            "platform": "EX4300 Series",
                            "version_affected": "\u003c",
                            "version_name": "18.2",
                            "version_value": "18.2R2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Juniper Networks"
              }
            ]
          }
        },
        "configuration": [
          {
            "lang": "en",
            "value": "This issue affects Junos OS device with stateless IPv4 or IPv6 firewall filter configured:\n  [firewall family inet filter]\n  [firewall family inet6 filter]"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "On EX4300, EX4600, QFX3500, and QFX5100 Series, a vulnerability in the IP firewall filter component may cause the firewall filter evaluation of certain packets to fail. This issue only affects firewall filter evaluation of certain packets destined to the device Routing Engine (RE). This issue does not affect the Layer 2 firewall filter evaluation nor does it affect the Layer 3 firewall filter evaluation destined to connected hosts. This issue may occur when evaluating both IPv4 or IPv6 packets. This issue affects Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D12 on QFX5100 Series and EX4600 Series; 14.1X53 versions prior to 14.1X53-D52 on QFX3500 Series; 14.1X53 versions prior to 14.1X53-D48 on EX4300 Series; 15.1 versions prior to 15.1R7-S3 on EX4300 Series; 16.1 versions prior to 16.1R7 on EX4300 Series; 17.1 versions prior to 17.1R3 on EX4300 Series; 17.2 versions prior to 17.2R3 on EX4300 Series; 17.3 versions prior to 17.3R2-S5, 17.3R3 on EX4300 Series; 17.4 versions prior to 17.4R2 on EX4300 Series; 18.1 versions prior to 18.1R3 on EX4300 Series; 18.2 versions prior to 18.2R2 on EX4300 Series."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
          }
        ],
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-284 Improper Access Control"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://kb.juniper.net/JSA10983",
              "refsource": "CONFIRM",
              "url": "https://kb.juniper.net/JSA10983"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "For QFX5100 Series and EX4600 Series:\nThe following software releases have been updated to resolve this specific issue: 14.1X53-D12 and all subsequent releases.\n\nFor QFX3500 Series:\nThe following software releases have been updated to resolve this specific issue: 14.1X53-D52 and all subsequent releases.\n\nFor EX4300 Series: \nThe following software releases have been updated to resolve this specific issue: 14.1X53-D48, 15.1R7-S3, 16.1R7, 17.1R3, 17.2R3, 17.3R2-S5, 17.3R3, 17.4R2, 18.1R3, 18.2R2, 18.3R1 and all subsequent releases."
          }
        ],
        "source": {
          "advisory": "JSA10983",
          "defect": [
            "1026708",
            "1458027",
            "1343402",
            "1377189"
          ],
          "discovery": "USER"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "There are no known workarounds for this issue."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
    "assignerShortName": "juniper",
    "cveId": "CVE-2020-1604",
    "datePublished": "2020-01-15T08:40:35.801982Z",
    "dateReserved": "2019-11-04T00:00:00",
    "dateUpdated": "2024-09-16T16:43:21.771Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted