FKIE_CVE-2020-1649
Vulnerability from fkie_nvd - Published: 2020-07-17 19:15 - Updated: 2024-11-21 05:11
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
When a device running Juniper Networks Junos OS with MPC7, MPC8, or MPC9 line cards installed and the system is configured for inline IP reassembly, used by L2TP, MAP-E, GRE, and IPIP, the packet forwarding engine (PFE) will become disabled upon receipt of small fragments requiring reassembly, generating the following error messages: [LOG: Err] MQSS(2): WO: Packet Error - Error Packets 1, Connection 29 [LOG: Err] eachip_hmcif_rx_intr_handler(7259): EA[2:0]: HMCIF Rx: Injected checksum error detected on WO response - Chunk Address 0x0 [LOG: Err] MQSS(2): DRD: RORD1: CMD reorder ID error - Command 11, Reorder ID 1960, QID 0 [LOG: Err] MQSS(2): DRD: UNROLL0: HMC chunk address error in stage 5 - Chunk Address: 0xc38fb1 [LOG: Notice] Error: /fpc/0/pfe/0/cm/0/MQSS(2)/2/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc), scope: pfe, category: functional, severity: major, module: MQSS(2), type: DRD_RORD_ENG_INT: CMD FSM State Error [LOG: Notice] Performing action cmalarm for error /fpc/0/pfe/0/cm/0/MQSS(2)/2/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc) in module: MQSS(2) with scope: pfe category: functional level: major [LOG: Notice] Performing action get-state for error /fpc/0/pfe/0/cm/0/MQSS(2)/2/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc) in module: MQSS(2) with scope: pfe category: functional level: major [LOG: Notice] Performing action disable-pfe for error /fpc/0/pfe/0/cm/0/MQSS(2)/2/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc) in module: MQSS(2) with scope: pfe category: functional level: major By continuously sending fragmented packets that cannot be reassembled, an attacker can repeatedly disable the PFE causing a sustained Denial of Service (DoS). This issue affects Juniper Networks Junos OS: 17.2 versions prior to 17.2R3-S4 on MX Series; 17.3 versions prior to 17.3R3-S8 on MX Series; 17.4 versions prior to 17.4R2-S9, 17.4R3-S1 on MX Series; 18.1 versions prior to 18.1R3-S10 on MX Series; 18.2 versions prior to 18.2R2-S6, 18.2R3-S3 on MX Series; 18.2X75 versions prior to 18.2X75-D34, 18.2X75-D41, 18.2X75-D53, 18.2X75-D65, 18.2X75-D430 on MX Series; 18.3 versions prior to 18.3R1-S7, 18.3R2-S4, 18.3R3-S2 on MX Series; 18.4 versions prior to 18.4R1-S6, 18.4R2-S4, 18.4R3 on MX Series; 19.1 versions prior to 19.1R1-S4, 19.1R2-S1, 19.1R3 on MX Series; 19.2 versions prior to 19.2R1-S3, 19.2R2 on MX Series; 19.3 versions prior to 19.3R2-S2, 19.3R3 on MX Series. This issue is specific to inline IP reassembly, introduced in Junos OS 17.2. Versions of Junos OS prior to 17.2 are unaffected by this vulnerability.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:juniper:junos:17.2:-:*:*:*:*:*:*",
"matchCriteriaId": "BCEE8D9C-6D64-4A9B-A74A-57A0BF4086C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.2:r1:*:*:*:*:*:*",
"matchCriteriaId": "E889BF9C-BDDF-4A6A-97BB-00A097EF6D91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.2:r1-s1:*:*:*:*:*:*",
"matchCriteriaId": "8BCF0612-AF16-4925-8E42-77734513F923",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.2:r1-s2:*:*:*:*:*:*",
"matchCriteriaId": "595987A6-D8CE-41ED-B51C-EF9CD3B47AD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.2:r1-s3:*:*:*:*:*:*",
"matchCriteriaId": "7B5A2205-C40B-4746-9A23-1973433FF065",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.2:r1-s4:*:*:*:*:*:*",
"matchCriteriaId": "CFA3526C-FF53-4823-B6AC-0BA91BFB532D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.2:r1-s5:*:*:*:*:*:*",
"matchCriteriaId": "AA92B7F8-705B-410F-BDA3-7C28FF51967F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.2:r1-s7:*:*:*:*:*:*",
"matchCriteriaId": "9689695F-53EB-4B35-9072-750E7282B011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.2:r1-s8:*:*:*:*:*:*",
"matchCriteriaId": "4F7CE683-5647-455B-936C-DF0D973A180A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.2:r2:*:*:*:*:*:*",
"matchCriteriaId": "7D45F2C3-20FF-4A91-A440-E109B3CCE7C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.2:r2-s11:*:*:*:*:*:*",
"matchCriteriaId": "BA433E05-83F8-410D-AEB3-3A02BAB0BE0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.2:r2-s6:*:*:*:*:*:*",
"matchCriteriaId": "B87ECEAD-FD18-4252-8D46-F281DD4125AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.2:r2-s7:*:*:*:*:*:*",
"matchCriteriaId": "C6788EE2-B0DA-470E-B72E-E8D5CCFB5259",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.2:r3-s1:*:*:*:*:*:*",
"matchCriteriaId": "5FD8A8E1-201B-4E4E-8F69-23856E56AF60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.2:r3-s2:*:*:*:*:*:*",
"matchCriteriaId": "897850A3-2A27-483C-8266-E4547F1A4341",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.2:r3-s3:*:*:*:*:*:*",
"matchCriteriaId": "7939BCE6-D4E8-4366-B954-32D77F21A35D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.3:-:*:*:*:*:*:*",
"matchCriteriaId": "A283D32F-1CAF-4A5A-83E1-585F2801771F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.3:r1-s1:*:*:*:*:*:*",
"matchCriteriaId": "C52E355B-DA7D-4FDE-B2D7-A3C3C9C99918",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.3:r2:*:*:*:*:*:*",
"matchCriteriaId": "69FC46D4-39E2-4E2F-A1D3-1001769A7115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.3:r2-s1:*:*:*:*:*:*",
"matchCriteriaId": "32F83E8B-A816-4F26-95F8-F0DA7F3DF426",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.3:r2-s2:*:*:*:*:*:*",
"matchCriteriaId": "2C433359-BC8B-4E69-BE74-A31EB148083A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.3:r2-s3:*:*:*:*:*:*",
"matchCriteriaId": "BCA2976C-C84B-40D9-A806-588629BFFB13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.3:r2-s4:*:*:*:*:*:*",
"matchCriteriaId": "A2C7B980-033E-40AC-98C9-B252733B0F43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.3:r3:-:*:*:*:*:*",
"matchCriteriaId": "D1CAEBD2-2E46-44B5-B1D1-1DDBD450FD27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.3:r3-s1:*:*:*:*:*:*",
"matchCriteriaId": "565AE6D8-28A9-4A62-A886-5BAB954695D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.3:r3-s2:*:*:*:*:*:*",
"matchCriteriaId": "0C366F93-BB30-4144-99AE-40B676977834",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.3:r3-s3:*:*:*:*:*:*",
"matchCriteriaId": "488BB10A-1360-42E5-A68D-23D51B332850",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.3:r3-s4:*:*:*:*:*:*",
"matchCriteriaId": "64988F0A-E02C-455B-99C9-4059C896416F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.3:r3-s7:*:*:*:*:*:*",
"matchCriteriaId": "C9C703CA-9309-413A-9CD7-585277ADD32D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:-:*:*:*:*:*:*",
"matchCriteriaId": "A00CA6FB-8F28-4171-B510-8DBA351E80C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:r1:*:*:*:*:*:*",
"matchCriteriaId": "988D317A-0646-491F-9B97-853E8E208276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:r1-s1:*:*:*:*:*:*",
"matchCriteriaId": "605F1AD7-5B09-44F0-9017-15AB3EEE559C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:r1-s2:*:*:*:*:*:*",
"matchCriteriaId": "CEDDCD30-2255-4FA9-B3E2-9E88AB6F8D80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:r1-s4:*:*:*:*:*:*",
"matchCriteriaId": "4E4EB6B0-8DB2-4199-96E4-30195D49F756",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:r1-s5:*:*:*:*:*:*",
"matchCriteriaId": "204FC7B5-9CF2-4AC2-9B8D-DA48CAEA6496",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:r1-s6:*:*:*:*:*:*",
"matchCriteriaId": "9D8A8E33-473A-4A40-A7B7-47086BB9012A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:r1-s7:*:*:*:*:*:*",
"matchCriteriaId": "F0F65DCA-34B9-4CE8-91C9-426AAAEB4097",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:r2:*:*:*:*:*:*",
"matchCriteriaId": "0E0CE79A-157D-47DE-BE65-936BC12470EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:r2-s1:*:*:*:*:*:*",
"matchCriteriaId": "05060C06-18C1-40E8-AE01-385B036CC9AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:r2-s10:*:*:*:*:*:*",
"matchCriteriaId": "341417EE-71C2-465C-96CA-65B2B5B63FF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:r2-s2:*:*:*:*:*:*",
"matchCriteriaId": "0C752783-4843-407B-AF33-0E1D36FCAAF8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:r2-s3:*:*:*:*:*:*",
"matchCriteriaId": "006EE425-A146-4E10-B050-7E754BB8402A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:r2-s4:*:*:*:*:*:*",
"matchCriteriaId": "2B482BCC-1F0C-47AA-B63B-1B39CEF7B2C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:r2-s5:*:*:*:*:*:*",
"matchCriteriaId": "A636F9F2-2DA7-4A27-AD80-FD1B34DFCA94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:r2-s6:*:*:*:*:*:*",
"matchCriteriaId": "4EC7D216-D8F3-4ABD-97C9-4C9FB6DF64FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:r2-s7:*:*:*:*:*:*",
"matchCriteriaId": "5E327643-D8D8-4EFA-9F38-BA862A919501",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:r2-s8:*:*:*:*:*:*",
"matchCriteriaId": "1BC6CE1C-9DD8-429E-BDC2-251D8C8674E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:17.4:r3:*:*:*:*:*:*",
"matchCriteriaId": "8732E25A-9073-4C7B-9E89-C02368728EB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.1:-:*:*:*:*:*:*",
"matchCriteriaId": "0DFDD907-5305-4602-8A9C-685AA112C342",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.1:r1:*:*:*:*:*:*",
"matchCriteriaId": "B0A756E2-C320-405A-B24F-7C5022649E5A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.1:r2:*:*:*:*:*:*",
"matchCriteriaId": "2EF6F4C1-6A7E-474F-89BC-7A3C50FD8CAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.1:r2-s1:*:*:*:*:*:*",
"matchCriteriaId": "84F5BCBA-404B-4BC9-B363-CE6D231B0D6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.1:r2-s2:*:*:*:*:*:*",
"matchCriteriaId": "18A4CA3E-DA61-49CC-8476-3A476CCB2B83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.1:r2-s4:*:*:*:*:*:*",
"matchCriteriaId": "A7380B3E-09F5-4497-86C6-11EF56BD89F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.1:r3:*:*:*:*:*:*",
"matchCriteriaId": "658841A9-BEC9-433E-81D0-47DE82887C4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.1:r3-s1:*:*:*:*:*:*",
"matchCriteriaId": "5AD05209-1274-4F8A-9FA2-A1A8DFCC5755",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.1:r3-s2:*:*:*:*:*:*",
"matchCriteriaId": "C97683B3-A07B-428F-9535-C49B55305679",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.1:r3-s3:*:*:*:*:*:*",
"matchCriteriaId": "A14CE132-C56B-43D8-A248-AB6A2D1A7B6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.1:r3-s4:*:*:*:*:*:*",
"matchCriteriaId": "73978DD8-BD92-4872-8F35-AF2B9BCA1ECB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.1:r3-s6:*:*:*:*:*:*",
"matchCriteriaId": "7988CE92-71D2-4EEC-B596-4A60E2C1136A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.1:r3-s7:*:*:*:*:*:*",
"matchCriteriaId": "330D176F-8DAD-440C-A623-44FA233FAB01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.1:r3-s8:*:*:*:*:*:*",
"matchCriteriaId": "8CC5EAB8-1364-4325-9F01-BE7CC479C29D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.1:r3-s9:*:*:*:*:*:*",
"matchCriteriaId": "4E2E933A-852F-4257-860D-09638EE0D2F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.2:-:*:*:*:*:*:*",
"matchCriteriaId": "A8B5BD93-3C11-45D5-ACF0-7C4C01106C8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.2:r1:*:*:*:*:*:*",
"matchCriteriaId": "167EEC4F-729E-47C2-B0F8-E8108CE3E985",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.2:r1:-:*:*:*:*:*",
"matchCriteriaId": "90BF177D-A895-4D05-B674-B27420A5DC6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.2:r1-s3:*:*:*:*:*:*",
"matchCriteriaId": "A893CCE5-96B8-44A1-ABEF-6AB9B527B2FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.2:r1-s4:*:*:*:*:*:*",
"matchCriteriaId": "42203801-E2E7-4DCF-ABBB-D23A91B2A9FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.2:r1-s5:*:*:*:*:*:*",
"matchCriteriaId": "238EC996-8E8C-4332-916F-09E54E6EBB9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.2:r2:*:*:*:*:*:*",
"matchCriteriaId": "5F711936-33A1-47FC-A6A0-A63088915815",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.2:r2-s1:*:*:*:*:*:*",
"matchCriteriaId": "21B7820C-01D2-401C-9E6D-C83994FD5961",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.2:r2-s2:*:*:*:*:*:*",
"matchCriteriaId": "3D2FBD29-2CAC-41B4-9336-671373EF4A7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.2:r2-s3:*:*:*:*:*:*",
"matchCriteriaId": "EEFCDA90-67E2-4AEF-800C-1D29A9121B8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.2:r2-s4:*:*:*:*:*:*",
"matchCriteriaId": "74B99981-840F-4DAD-976A-5DAEFE9FB93D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.2:r2-s5:*:*:*:*:*:*",
"matchCriteriaId": "BDD3ADB9-35FF-41D3-92BD-98D6D4826B03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.2:r3:*:*:*:*:*:*",
"matchCriteriaId": "B670F988-78F2-4BC6-B7FC-E34C280F67DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.2:r3-s1:*:*:*:*:*:*",
"matchCriteriaId": "2F9451C7-6466-4AC9-9A7F-90A2817AED6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.2:r3-s2:*:*:*:*:*:*",
"matchCriteriaId": "871CA952-C5EC-4A25-8EF0-C2EC484F7DE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.2x75:-:*:*:*:*:*:*",
"matchCriteriaId": "EEC6BBCF-6429-4BD8-9728-4A1B0616D7C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.2x75:d20:*:*:*:*:*:*",
"matchCriteriaId": "12805C4D-2737-41E4-8950-5B48636765F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.2x75:d30:*:*:*:*:*:*",
"matchCriteriaId": "C680D835-0262-46BF-B120-DFBFF377341E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.3:-:*:*:*:*:*:*",
"matchCriteriaId": "1BB9C2BB-D20B-41E9-B75F-7FAD9ECCDB99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.3:r1:*:*:*:*:*:*",
"matchCriteriaId": "5342C3DC-D640-47AB-BD76-3444852988A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.3:r1-s1:*:*:*:*:*:*",
"matchCriteriaId": "8AB8585E-EDC6-4400-BEE3-3A6A7C922C90",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.3:r1-s2:*:*:*:*:*:*",
"matchCriteriaId": "A2ABC574-B3FC-4025-B50D-7F9EEB28C806",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.3:r1-s3:*:*:*:*:*:*",
"matchCriteriaId": "6F6EAFC3-C3AC-4361-8530-39FCF89702F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.3:r1-s5:*:*:*:*:*:*",
"matchCriteriaId": "6B363298-315C-4FD5-9417-C5B82883A224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.3:r1-s6:*:*:*:*:*:*",
"matchCriteriaId": "EB08FF7B-01F5-4A19-858E-E2CD19D61A62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.3:r2:*:*:*:*:*:*",
"matchCriteriaId": "B7A3FBD3-5399-42A9-9BD9-E3C981CBD6DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.3:r2-s1:*:*:*:*:*:*",
"matchCriteriaId": "4EBD361C-8B4D-43EF-8B82-9FE165D8206E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.3:r2-s2:*:*:*:*:*:*",
"matchCriteriaId": "6E7539C4-6208-43EB-9A0B-4852D0CE0FA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.3:r2-s3:*:*:*:*:*:*",
"matchCriteriaId": "35299B02-DC75-458D-B86D-8A0DB95B06AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.3:r3:*:*:*:*:*:*",
"matchCriteriaId": "CFB29C9B-9729-43EB-AF98-AF44038DA711",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.3:r3-s1:*:*:*:*:*:*",
"matchCriteriaId": "2D1FB957-54C8-428E-BC8D-2802D7F6895F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.4:-:*:*:*:*:*:*",
"matchCriteriaId": "74CA9010-D3DE-487B-B46F-589A48AB0F0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.4:r1:*:*:*:*:*:*",
"matchCriteriaId": "A38F224C-8E9B-44F3-9D4F-6C9F04F57927",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.4:r1-s1:*:*:*:*:*:*",
"matchCriteriaId": "853F146A-9A0F-49B6-AFD2-9907434212F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.4:r1-s2:*:*:*:*:*:*",
"matchCriteriaId": "8F73B88B-E66C-4ACD-B38D-9365FB230ABA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.4:r1-s5:*:*:*:*:*:*",
"matchCriteriaId": "C012CD07-706A-4E1C-B399-C55AEF5C8309",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.4:r2:*:*:*:*:*:*",
"matchCriteriaId": "D59D7A31-128B-4034-862B-8EF3CE3EE949",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.4:r2-s1:*:*:*:*:*:*",
"matchCriteriaId": "0C5E097B-B79E-4E6A-9291-C8CB9674FED5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.4:r2-s2:*:*:*:*:*:*",
"matchCriteriaId": "819FA3ED-F934-4B20-BC0E-D638ACCB7787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:18.4:r2-s3:*:*:*:*:*:*",
"matchCriteriaId": "3D7D773A-4988-4D7C-A105-1885EBE14426",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:19.1:-:*:*:*:*:*:*",
"matchCriteriaId": "768C0EB7-8456-4BF4-8598-3401A54D21DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:19.1:r1:*:*:*:*:*:*",
"matchCriteriaId": "5332B70A-F6B0-4C3B-90E2-5CBFB3326126",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:19.1:r1-s1:*:*:*:*:*:*",
"matchCriteriaId": "81439FE8-5405-45C2-BC04-9823D2009A77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:19.1:r1-s2:*:*:*:*:*:*",
"matchCriteriaId": "E506138D-043E-485D-B485-94A2AB75F8E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:19.1:r1-s3:*:*:*:*:*:*",
"matchCriteriaId": "0EF3C901-3599-463F-BEFB-8858768DC195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:19.1:r2:*:*:*:*:*:*",
"matchCriteriaId": "DCAB79C9-6639-4ED0-BEC9-E7C8229DF977",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:19.2:-:*:*:*:*:*:*",
"matchCriteriaId": "0E7545CE-6300-4E81-B5AF-2BE150C1B190",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:19.2:r1:*:*:*:*:*:*",
"matchCriteriaId": "4CA3060F-1800-4A06-A453-FB8CE4B65312",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:19.2:r1-s1:*:*:*:*:*:*",
"matchCriteriaId": "9A5B337A-727C-4767-AD7B-E0F7F99EB46F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:19.2:r1-s2:*:*:*:*:*:*",
"matchCriteriaId": "16FDE60B-7A99-4683-BC14-530B5B005F8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:19.3:-:*:*:*:*:*:*",
"matchCriteriaId": "59006503-B2CA-4F79-AC13-7C5615A74CE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:19.3:r1:*:*:*:*:*:*",
"matchCriteriaId": "B8110DA9-54B1-43CF-AACB-76EABE0C9EF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:19.3:r1-s1:*:*:*:*:*:*",
"matchCriteriaId": "11B5CC5A-1959-4113-BFCF-E4BA63D918C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:19.3:r2:*:*:*:*:*:*",
"matchCriteriaId": "33F08A33-EF80-4D86-9A9A-9DF147B9B6D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:juniper:junos:19.3:r2-s1:*:*:*:*:*:*",
"matchCriteriaId": "AF24ACBD-5F84-47B2-BFF3-E9A56666269C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:juniper:mx10:-:*:*:*:*:*:*:*",
"matchCriteriaId": "52699E2B-450A-431C-81E3-DC4483C8B4F2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:juniper:mx10000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D97AF6F8-3D50-4D35-BCB1-54E3BEC69B9F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:juniper:mx10003:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D5627740-42E3-4FB1-B8B9-0B768AFFA1EC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:juniper:mx104:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F72C850A-0530-4DB7-A553-7E19F82122B5",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:juniper:mx150:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7FE2089C-F341-4DC1-B76D-633BC699306D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:juniper:mx2008:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2FEF33EB-B2E0-42EF-A1BB-D41021B6D08F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:juniper:mx2010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "27175D9A-CA2C-4218-8042-835E25DFCA43",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:juniper:mx2020:-:*:*:*:*:*:*:*",
"matchCriteriaId": "00C7FC57-8ACF-45AA-A227-7E3B350FD24F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:juniper:mx204:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2754C2DF-DF6E-4109-9463-38B4E0465B77",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:juniper:mx240:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F4A26704-A6A4-4C4F-9E12-A0A0259491EF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:juniper:mx40:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C982A2FF-A1F9-4830-BAB6-77CFCE1F093F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:juniper:mx480:-:*:*:*:*:*:*:*",
"matchCriteriaId": "104858BD-D31D-40E0-8524-2EC311F10EAC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:juniper:mx5:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3B557965-0040-4048-B56C-F564FF28635B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:juniper:mx80:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB875EBD-A3CD-4466-B2A3-39D47FF94592",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:juniper:mx960:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B5E08E1E-0FE4-4294-9497-BBFFECA2A220",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "When a device running Juniper Networks Junos OS with MPC7, MPC8, or MPC9 line cards installed and the system is configured for inline IP reassembly, used by L2TP, MAP-E, GRE, and IPIP, the packet forwarding engine (PFE) will become disabled upon receipt of small fragments requiring reassembly, generating the following error messages: [LOG: Err] MQSS(2): WO: Packet Error - Error Packets 1, Connection 29 [LOG: Err] eachip_hmcif_rx_intr_handler(7259): EA[2:0]: HMCIF Rx: Injected checksum error detected on WO response - Chunk Address 0x0 [LOG: Err] MQSS(2): DRD: RORD1: CMD reorder ID error - Command 11, Reorder ID 1960, QID 0 [LOG: Err] MQSS(2): DRD: UNROLL0: HMC chunk address error in stage 5 - Chunk Address: 0xc38fb1 [LOG: Notice] Error: /fpc/0/pfe/0/cm/0/MQSS(2)/2/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc), scope: pfe, category: functional, severity: major, module: MQSS(2), type: DRD_RORD_ENG_INT: CMD FSM State Error [LOG: Notice] Performing action cmalarm for error /fpc/0/pfe/0/cm/0/MQSS(2)/2/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc) in module: MQSS(2) with scope: pfe category: functional level: major [LOG: Notice] Performing action get-state for error /fpc/0/pfe/0/cm/0/MQSS(2)/2/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc) in module: MQSS(2) with scope: pfe category: functional level: major [LOG: Notice] Performing action disable-pfe for error /fpc/0/pfe/0/cm/0/MQSS(2)/2/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc) in module: MQSS(2) with scope: pfe category: functional level: major By continuously sending fragmented packets that cannot be reassembled, an attacker can repeatedly disable the PFE causing a sustained Denial of Service (DoS). This issue affects Juniper Networks Junos OS: 17.2 versions prior to 17.2R3-S4 on MX Series; 17.3 versions prior to 17.3R3-S8 on MX Series; 17.4 versions prior to 17.4R2-S9, 17.4R3-S1 on MX Series; 18.1 versions prior to 18.1R3-S10 on MX Series; 18.2 versions prior to 18.2R2-S6, 18.2R3-S3 on MX Series; 18.2X75 versions prior to 18.2X75-D34, 18.2X75-D41, 18.2X75-D53, 18.2X75-D65, 18.2X75-D430 on MX Series; 18.3 versions prior to 18.3R1-S7, 18.3R2-S4, 18.3R3-S2 on MX Series; 18.4 versions prior to 18.4R1-S6, 18.4R2-S4, 18.4R3 on MX Series; 19.1 versions prior to 19.1R1-S4, 19.1R2-S1, 19.1R3 on MX Series; 19.2 versions prior to 19.2R1-S3, 19.2R2 on MX Series; 19.3 versions prior to 19.3R2-S2, 19.3R3 on MX Series. This issue is specific to inline IP reassembly, introduced in Junos OS 17.2. Versions of Junos OS prior to 17.2 are unaffected by this vulnerability."
},
{
"lang": "es",
"value": "Cuando un dispositivo que ejecuta Juniper Networks Junos OS con tarjetas de l\u00ednea MPC7, MPC8 o MPC9 instaladas y el sistema est\u00e1 configurado para el reensamblado de IP en l\u00ednea, utilizado por L2TP, MAP-E, GRE e IPIP, el motor de reenv\u00edo de paquetes (PFE) cambiar\u00e1 a deshabilitado al recibir fragmentos peque\u00f1os que requieren reensamblado, generando los siguientes mensajes de error: [LOG: Err] MQSS(2): WO: Packet Error - Error Packets 1, Connection 29 [LOG: Err] eachip_hmcif_rx_intr_handler(7259): EA[2:0]: HMCIF Rx: Injected checksum error detected on WO response - Chunk Address 0x0 [LOG: Err] MQSS(2): DRD: RORD1: CMD reorder ID error - Command 11, Reorder ID 1960, QID 0 [LOG: Err] MQSS(2): DRD: UNROLL0: HMC chunk address error in stage 5 - Chunk Address: 0xc38fb1 [LOG: Notice] Error: /fpc/0/pfe/0/cm/0/MQSS(2)/2/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc), scope: pfe, category: functional, severity: major, module: MQSS(2), type: DRD_RORD_ENG_INT: CMD FSM State Error [LOG: Notice] Performing action cmalarm for error /fpc/0/pfe/0/cm/0/MQSS(2)/2/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc) in module: MQSS(2) with scope: pfe category: functional level: major [LOG: Notice] Performing action get-state for error /fpc/0/pfe/0/cm/0/MQSS(2)/2/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc) in module: MQSS(2) with scope: pfe category: functional level: major [LOG: Notice] Performing action disable-pfe for error /fpc/0/pfe/0/cm/0/MQSS(2)/2/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc) in module: MQSS(2) with scope: pfe category: functional level: major. Al enviar continuamente paquetes fragmentados que no se pueden volver a ensamblar, un atacante puede deshabilitar de forma repetida el PFE causando una Denegaci\u00f3n de Servicio (DoS) sostenida. Este problema afecta a Juniper Networks Junos OS: versiones 17.2 anteriores a 17.2R3-S4 en la Serie MX; versiones 17.3 anteriores a 17.3R3-S8 en la Serie MX; versiones 17.4 anteriores a 17.4R2-S9, 17.4R3-S1 en la Serie MX; versiones 18.1 anteriores a 18.1R3-S10 en la Serie MX; versiones 18.2 anteriores a 18.2R2-S6, 18.2R3-S3 en la Serie MX; versiones 18.2X75 anteriores a 18.2X75-D34, 18.2X75-D41, 18.2X75-D53, 18.2X75-D65, 18.2X75-D430 en la Serie MX; versiones 18.3 anteriores a 18.3R1-S7, 18.3R2-S4, 18.3R3-S2 en la Serie MX; versiones 18.4 anteriores a 18.4R1-S6, 18.4R2-S4, 18.4R3 en la Serie MX; versiones 19.1 anteriores a 19.1R1-S4, 19.1R2-S1, 19.1R3 en la Serie MX; versiones 19.2 anteriores a 19.2R1-S3, 19.2R2 en la Serie MX; versiones 19.3 anteriores a 19.3R2-S2, 19.3R3 en la Serie MX. Este problema es espec\u00edfico del reensamblado de IP en l\u00ednea, introducido en Junos OS versi\u00f3n 17.2. Las versiones de Junos OS anteriores a 17.2 no est\u00e1n afectadas por esta vulnerabilidad"
}
],
"id": "CVE-2020-1649",
"lastModified": "2024-11-21T05:11:04.903",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "sirt@juniper.net",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-07-17T19:15:13.377",
"references": [
{
"source": "sirt@juniper.net",
"tags": [
"Vendor Advisory"
],
"url": "https://kb.juniper.net/JSA11036"
},
{
"source": "sirt@juniper.net",
"tags": [
"Vendor Advisory"
],
"url": "https://www.juniper.net/documentation/en_US/junos/topics/topic-map/l2tp-lns-inline-service-interfaces.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://kb.juniper.net/JSA11036"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.juniper.net/documentation/en_US/junos/topics/topic-map/l2tp-lns-inline-service-interfaces.html"
}
],
"sourceIdentifier": "sirt@juniper.net",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…