CVE-2014-0616
HighSummary
Podatność w systemie Juniper Junos przed wersją 10.4R16, 11.4R10, 12.1R8-S2, 12.1X44-D30, 12.1X45-D20, 12.1X46-D10, 12.2R7, 12.3R4-S2, 13.1R3-S1, 13.2R2 oraz 13.3R1 pozwala zdalnym atakującym na spowodowanie awarii usługi (crash rdp) poprzez wysłanie dużej wiadomości BGP UPDATE, co natychmiastowo wyzwala wysłanie wiadomości wycofania. Przykładem może być długi AS_PATH oraz duża liczba BGP Communities.
Risk Assessment
Ryzyko dla organizacji polega na możliwości wystąpienia awarii usługi, co może prowadzić do przerw w dostępności sieci i zakłóceń w komunikacji. Atakujący mogą wykorzystać tę podatność do destabilizacji infrastruktury sieciowej.
Recommendation
Zaleca się aktualizację systemu Juniper Junos do najnowszej wersji, aby usunąć tę podatność. Dodatkowo warto monitorować ruch BGP w celu wykrywania potencjalnych prób ataków.
Related vulnerabilities
- CVE-2026-93467Critical
The OAKlouds developed by HGiga has an Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
- CVE-2026-85878Critical
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
- CVE-2026-69843Critical
Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-62874Critical
Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-87886HighActively exploited
The vulnerability is a local privilege escalation due to insecure file permissions. It affects Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, and Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
- CVE-2026-87701Critical
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
- CVE-2026-85889Critical
Missing authentication for a critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-85885Critical
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
- CVE-2026-83944Critical
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-77903Critical
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
Original NVD description (English source)
Juniper Junos 10.4 before 10.4R16, 11.4 before 11.4R10, 12.1R before 12.1R8-S2, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, 12.2 before 12.2R7, 12.3 before 12.3R4-S2, 13.1 before 13.1R3-S1, 13.2 before 13.2R2, and 13.3 before 13.3R1 allows remote attackers to cause a denial of service (rdp crash) via a large BGP UPDATE message which immediately triggers a withdraw message to be sent, as demonstrated by a long AS_PATH and a large number of BGP Communities.