CVE-2014-6378
HighSummary
Juniper Junos versions before R12-S4, D35, D30, D25, D10, R9, D70, R7, R4 before S3, D55, D30, R5, D20, D26, D30, D15, R3, and R1 are vulnerable to a remote attack that can cause a router protocol daemon crash via a crafted RSVP PATH message.
Risk Assessment
Attackers can remotely cause a system crash, leading to service interruptions that may affect the availability and stability of the organization's IT infrastructure.
Recommendation
It is recommended to upgrade to the latest version of Juniper Junos to mitigate this vulnerability and to monitor systems for unusual RSVP messages.
Other vulnerabilities in Juniper Junos
See all- CVE-2015-3003High
Juniper Junos versions before 12.1X44-D45, 12.1X46-D30, 12.1X47-D20, 12.3R9, 12.3X48-D10, 13.2R6, 13.3R5, 14.1R3, and 14.2R1 allow local users to gain privileges via crafted combinations of CLI commands and arguments.
- CVE-2014-6386High
Juniper Junos versions before 11.4R8, 12.1X44-D35, 12.1X45-D25, 12.1X46-D20, 12.1X47-D10, 12.2R9, 12.3R2-S3, 12.3R3, 13.1R4, and 13.2R1 are vulnerable to remote attacks that can cause denial of service through assertion failure and rpd restart via a crafted BGP FlowSpec prefix.
- CVE-2014-6380High
Juniper Junos versions before R11 in 11.4, before R9 in 12.1, and other listed versions are vulnerable to an attack that can lead to denial of service. Attackers can exploit specially crafted fragmented packets of CLNP, IPv4, or IPv6 to block the em driver and reset the FPC.
- CVE-2014-6379High
In Juniper Junos versions before R12, 12.1 before R10, and others listed, configuring a RADIUS accounting server may create an entry in /var/etc/pam_radius.conf, allowing remote attackers to bypass authentication.
- CVE-2014-3819High
Juniper Junos versions before 11.4R12, 12.1R10, 12.1X44-D35, 12.1X45-D25, 12.1X46-D20, 12.1X47-D10, 12.2R8, 12.3R7, 13.1R4, 13.2R4, 13.3R2, and 14.1R1 with Auto-RP enabled are vulnerable to an attack that can cause a denial of service (RDP routing process crash and restart) via a malformed PIM packet.
- CVE-2014-3816High
Juniper Junos versions before 11.4R12, 12.1R11, 12.1X44-D35, 12.1X45-D30, 12.1X46-D20, 12.1X47-D10, 12.2R8-S2, 12.3R7, 13.1R4-S2, 13.2R5, 13.3R2-S2, and 14.1R1 allow remote authenticated users to gain privileges via unspecified combinations of CLI commands and arguments.
- CVE-2014-0614High
Juniper Junos versions 13.2 before 13.2R3 and 13.3 before 13.3R1, when PIM is enabled, allow remote attackers to cause a denial of service (kernel panic and crash) via a large number of crafted IGMP packets.
Original NVD description (English source)
Juniper Junos 11.4 before R12-S4, 12.1X44 before D35, 12.1X45 before D30, 12.1X46 before D25, 12.1X47 before D10, 12.2 before R9, 12.2X50 before D70, 12.3 before R7, 13.1 before R4 before S3, 13.1X49 before D55, 13.1X50 before D30, 13.2 before R5, 13.2X50 before D20, 13.2X51 before D26 and D30, 13.2X52 before D15, 13.3 before R3, and 14.1 before R1 allows remote attackers to cause a denial of service (router protocol daemon crash) via a crafted RSVP PATH message.