Vulnerability identifier: #VU52228
Vulnerability risk: Medium
CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-401
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Juniper Junos OS
Operating systems & Components /
Operating system
Vendor: Juniper Networks, Inc.
Description
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak. On Juniper Networks MX Series and EX9200 Series platforms with Trio-based MPCs (Modular Port Concentrators) where Integrated Routing and Bridging (IRB) interfaces are configured and mapped to a VPLS instance or a Bridge-Domain, certain Layer 2 network events at Customer Edge (CE) devices may cause memory leaks in the MPC of Provider Edge (PE) devices which can cause an out of memory condition and MPC restart.
Mitigation
Install updates from vendor's website.
This issue affects:
Juniper Networks Junos OS on MX Series, EX9200 Series
This issue does not affect Juniper Networks Junos OS:
Vulnerable software versions
Juniper Junos OS: 19.2 - 19.2R3-S1, 19.2R1-S4, 20.2 - 20.2R2-S3, 18.2 - 18.2R3-S6, 20.4, 20.3 - 20.3R1-S2, 18.3 - 18.3R3-S3, 18.3R2-S3, 18.3R3-S1, 19.3 - 19.3R3, 19.3R1-S1, 19.3R2 - 19.3R2-S7, 19.4 - 19.4R2-S8, 19.4R1 - 19.4R1-S4, 18.4 - 18.4R3-S5, 18.4R1-S5, 18.4R2-S3, 17.4 - 17.4R3-S2, 17.4R2-S9, 17.3 - 17.3R3-S9, 20.1 - 20.1R1-S4
External links
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA11148&cat=SIRT_1&actp=LIST
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.