var-200805-0297
Vulnerability from variot
Unspecified vulnerability in Century routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages, leading to route flapping, possibly a related issue to CVE-2007-6372. Multiple vendors' BGP implementations are prone to a remote denial-of-service vulnerability that arises when the software handles specially crafted BGP packets. It has been assigned its own record because details regarding what technologies are vulnerable and how the various vendors have implemented BGP are not currently available. As more information emerges, we will create individual records to further document the vulnerability for the various vulnerable technologies. AlaxalA Networks AX series and Hitachi GR series are reported vulnerable to this issue. Unspecified technologies from Avici Systems, Inc., Century Systems Inc., and Yamaha Corporation are also reported vulnerable. Juniper Networks Juniper Junos is a set of network operating system of Juniper Networks (Juniper Networks) dedicated to the company's hardware system. The operating system provides a secure programming interface and Junos SDK. There is a loophole in the implementation of the BGP protocol in JUNOS, and a remote attacker may take advantage of this loophole. ----------------------------------------------------------------------
Secunia Network Software Inspector 2.0 (NSI) - Public Beta
The Public Beta has ended. Thanks to all that participated.
Learn more: http://secunia.com/network_software_inspector_2/
TITLE: ALAXALA Networks AX Series BGP UPDATE Message Processing Denial of Service
SECUNIA ADVISORY ID: SA30054
VERIFY ADVISORY: http://secunia.com/advisories/30054/
CRITICAL: Moderately critical
IMPACT: DoS
WHERE:
From remote
OPERATING SYSTEM: ALAXALA Networks AX7800S Series http://secunia.com/product/5125/ ALAXALA Networks AX7800R Series http://secunia.com/product/5124/ ALAXALA Networks AX7700R http://secunia.com/product/11176/ ALAXALA Networks AX5400S Series http://secunia.com/product/5126/ ALAXALA Networks AX3600S Series http://secunia.com/product/11174/ ALAXALA Networks AX2400S Series http://secunia.com/product/11175/ ALAXALA Networks AX2000R Series http://secunia.com/product/11177/
DESCRIPTION: A vulnerability has been reported in ALAXALA Networks AX series, which can be exploited by malicious people to cause a DoS (Denial of Service).
SOLUTION: Restrict network access on affected systems.
PROVIDED AND/OR DISCOVERED BY: Reported via US-CERT.
ORIGINAL ADVISORY: US-CERT VU#929656: http://www.kb.cert.org/vuls/id/929656
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-200805-0297", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "router", "scope": null, "trust": 1.4, "vendor": "century", "version": null }, { "model": "router", "scope": "eq", "trust": 1.0, "vendor": "century", "version": "*" }, { "model": "gr4000", "scope": null, "trust": 0.3, "vendor": "hitachi", "version": null }, { "model": "gr3000", "scope": null, "trust": 0.3, "vendor": "hitachi", "version": null }, { "model": "gr2000-bh", "scope": null, "trust": 0.3, "vendor": "hitachi", "version": null }, { "model": "gr2000-2b+", "scope": null, "trust": 0.3, "vendor": "hitachi", "version": null }, { "model": "gr2000-2b", "scope": null, "trust": 0.3, "vendor": "hitachi", "version": null }, { "model": "gr2000-1b", "scope": null, "trust": 0.3, "vendor": "hitachi", "version": null }, { "model": "alaxala ax", "scope": null, "trust": 0.3, "vendor": "hitachi", "version": null }, { "model": "networks ax7800s", "scope": null, "trust": 0.3, "vendor": "alaxala", "version": null }, { "model": "networks ax7800r", "scope": null, "trust": 0.3, "vendor": "alaxala", "version": null }, { "model": "networks ax7700r", "scope": "eq", "trust": 0.3, "vendor": "alaxala", "version": "0" }, { "model": "networks ax5400s", "scope": null, "trust": 0.3, "vendor": "alaxala", "version": null }, { "model": "networks ax3600s", "scope": "eq", "trust": 0.3, "vendor": "alaxala", "version": "0" }, { "model": "networks ax2400s", "scope": "eq", "trust": 0.3, "vendor": "alaxala", "version": "0" }, { "model": "networks ax2000r", "scope": "eq", "trust": 0.3, "vendor": "alaxala", "version": "0" } ], "sources": [ { "db": "BID", "id": "28999" }, { "db": "JVNDB", "id": "JVNDB-2008-003047" }, { "db": "NVD", "id": "CVE-2008-2170" }, { "db": "CNNVD", "id": "CNNVD-200805-125" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:century_software:router:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2008-2170" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Juniper Networks", "sources": [ { "db": "CNNVD", "id": "CNNVD-200805-125" } ], "trust": 0.6 }, "cve": "CVE-2008-2170", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "NVD", "availabilityImpact": "COMPLETE", "baseScore": 7.1, "confidentialityImpact": "NONE", "exploitabilityScore": 8.6, "impactScore": 6.9, "integrityImpact": "NONE", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Medium", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "Complete", "baseScore": 7.1, "confidentialityImpact": "None", "exploitabilityScore": null, "id": "CVE-2008-2170", "impactScore": null, "integrityImpact": "None", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "High", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0" }, { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "COMPLETE", "baseScore": 7.1, "confidentialityImpact": "NONE", "exploitabilityScore": 8.6, "id": "VHN-32295", "impactScore": 6.9, "integrityImpact": "NONE", "severity": "HIGH", "trust": 0.1, "vectorString": "AV:N/AC:M/AU:N/C:N/I:N/A:C", "version": "2.0" } ], "cvssV3": [], "severity": [ { "author": "NVD", "id": "CVE-2008-2170", "trust": 1.8, "value": "HIGH" }, { "author": "CNNVD", "id": "CNNVD-200805-125", "trust": 0.6, "value": "HIGH" }, { "author": "VULHUB", "id": "VHN-32295", "trust": 0.1, "value": "HIGH" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-32295" }, { "db": "JVNDB", "id": "JVNDB-2008-003047" }, { "db": "NVD", "id": "CVE-2008-2170" }, { "db": "CNNVD", "id": "CNNVD-200805-125" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Unspecified vulnerability in Century routers allows remote attackers to cause a denial of service (dropped session) via crafted BGP UPDATE messages, leading to route flapping, possibly a related issue to CVE-2007-6372. Multiple vendors\u0027 BGP implementations are prone to a remote denial-of-service vulnerability that arises when the software handles specially crafted BGP packets. It has been assigned its own record because details regarding what technologies are vulnerable and how the various vendors have implemented BGP are not currently available. As more information emerges, we will create individual records to further document the vulnerability for the various vulnerable technologies. \nAlaxalA Networks AX series and Hitachi GR series are reported vulnerable to this issue. Unspecified technologies from Avici Systems, Inc., Century Systems Inc., and Yamaha Corporation are also reported vulnerable. Juniper Networks Juniper Junos is a set of network operating system of Juniper Networks (Juniper Networks) dedicated to the company\u0027s hardware system. The operating system provides a secure programming interface and Junos SDK. There is a loophole in the implementation of the BGP protocol in JUNOS, and a remote attacker may take advantage of this loophole. ----------------------------------------------------------------------\n\nSecunia Network Software Inspector 2.0 (NSI) - Public Beta\n\nThe Public Beta has ended. Thanks to all that participated. \n\nLearn more:\nhttp://secunia.com/network_software_inspector_2/\n\n----------------------------------------------------------------------\n\nTITLE:\nALAXALA Networks AX Series BGP UPDATE Message Processing Denial of\nService\n\nSECUNIA ADVISORY ID:\nSA30054\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/30054/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nDoS\n\nWHERE:\n\u003eFrom remote\n\nOPERATING SYSTEM:\nALAXALA Networks AX7800S Series\nhttp://secunia.com/product/5125/\nALAXALA Networks AX7800R Series\nhttp://secunia.com/product/5124/\nALAXALA Networks AX7700R\nhttp://secunia.com/product/11176/\nALAXALA Networks AX5400S Series\nhttp://secunia.com/product/5126/\nALAXALA Networks AX3600S Series\nhttp://secunia.com/product/11174/\nALAXALA Networks AX2400S Series\nhttp://secunia.com/product/11175/\nALAXALA Networks AX2000R Series\nhttp://secunia.com/product/11177/\n\nDESCRIPTION:\nA vulnerability has been reported in ALAXALA Networks AX series,\nwhich can be exploited by malicious people to cause a DoS (Denial of\nService). \n\nSOLUTION:\nRestrict network access on affected systems. \n\nPROVIDED AND/OR DISCOVERED BY:\nReported via US-CERT. \n\nORIGINAL ADVISORY:\nUS-CERT VU#929656:\nhttp://www.kb.cert.org/vuls/id/929656\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n", "sources": [ { "db": "NVD", "id": "CVE-2008-2170" }, { "db": "JVNDB", "id": "JVNDB-2008-003047" }, { "db": "BID", "id": "28999" }, { "db": "VULHUB", "id": "VHN-32295" }, { "db": "PACKETSTORM", "id": "66123" }, { "db": "PACKETSTORM", "id": "66130" } ], "trust": 2.16 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "CERT/CC", "id": "VU#929656", "trust": 3.0 }, { "db": "NVD", "id": "CVE-2008-2170", "trust": 2.8 }, { "db": "BID", "id": "28999", "trust": 2.0 }, { "db": "JVNDB", "id": "JVNDB-2008-003047", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-200805-125", "trust": 0.7 }, { "db": "SECUNIA", "id": "30054", "trust": 0.2 }, { "db": "SECUNIA", "id": "30028", "trust": 0.2 }, { "db": "VULHUB", "id": "VHN-32295", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "66123", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "66130", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-32295" }, { "db": "BID", "id": "28999" }, { "db": "JVNDB", "id": "JVNDB-2008-003047" }, { "db": "PACKETSTORM", "id": "66123" }, { "db": "PACKETSTORM", "id": "66130" }, { "db": "NVD", "id": "CVE-2008-2170" }, { "db": "CNNVD", "id": "CNNVD-200805-125" } ] }, "id": "VAR-200805-0297", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-32295" } ], "trust": 0.01 }, "last_update_date": "2023-12-18T12:39:34.777000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "Top Page", "trust": 0.8, "url": "http://www.centurysoftware.com/" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2008-003047" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-20", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-32295" }, { "db": "JVNDB", "id": "JVNDB-2008-003047" }, { "db": "NVD", "id": "CVE-2008-2170" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 3.0, "url": "http://www.kb.cert.org/vuls/id/929656" }, { "trust": 1.7, "url": "http://www.securityfocus.com/bid/28999" }, { "trust": 0.8, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-2170" }, { "trust": 0.8, "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-2170" }, { "trust": 0.2, "url": "http://secunia.com/secunia_security_advisories/" }, { "trust": 0.2, "url": "http://secunia.com/network_software_inspector_2/" }, { "trust": 0.2, "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org" }, { "trust": 0.2, "url": "http://secunia.com/about_secunia_advisories/" }, { "trust": 0.1, "url": "http://secunia.com/product/5126/" }, { "trust": 0.1, "url": "http://secunia.com/product/11176/" }, { "trust": 0.1, "url": "http://secunia.com/product/11174/" }, { "trust": 0.1, "url": "http://secunia.com/product/11177/" }, { "trust": 0.1, "url": "http://secunia.com/advisories/30054/" }, { "trust": 0.1, "url": "http://secunia.com/product/5125/" }, { "trust": 0.1, "url": "http://secunia.com/product/11175/" }, { "trust": 0.1, "url": "http://secunia.com/product/5124/" }, { "trust": 0.1, "url": "http://secunia.com/advisories/30028/" }, { "trust": 0.1, "url": "http://secunia.com/product/5131/" }, { "trust": 0.1, "url": "http://secunia.com/product/5129/" } ], "sources": [ { "db": "VULHUB", "id": "VHN-32295" }, { "db": "BID", "id": "28999" }, { "db": "JVNDB", "id": "JVNDB-2008-003047" }, { "db": "PACKETSTORM", "id": "66123" }, { "db": "PACKETSTORM", "id": "66130" }, { "db": "NVD", "id": "CVE-2008-2170" }, { "db": "CNNVD", "id": "CNNVD-200805-125" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-32295" }, { "db": "BID", "id": "28999" }, { "db": "JVNDB", "id": "JVNDB-2008-003047" }, { "db": "PACKETSTORM", "id": "66123" }, { "db": "PACKETSTORM", "id": "66130" }, { "db": "NVD", "id": "CVE-2008-2170" }, { "db": "CNNVD", "id": "CNNVD-200805-125" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2008-05-13T00:00:00", "db": "VULHUB", "id": "VHN-32295" }, { "date": "2008-05-01T00:00:00", "db": "BID", "id": "28999" }, { "date": "2012-06-26T00:00:00", "db": "JVNDB", "id": "JVNDB-2008-003047" }, { "date": "2008-05-08T17:30:50", "db": "PACKETSTORM", "id": "66123" }, { "date": "2008-05-08T17:30:50", "db": "PACKETSTORM", "id": "66130" }, { "date": "2008-05-13T22:20:00", "db": "NVD", "id": "CVE-2008-2170" }, { "date": "2007-12-14T00:00:00", "db": "CNNVD", "id": "CNNVD-200805-125" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2008-09-05T00:00:00", "db": "VULHUB", "id": "VHN-32295" }, { "date": "2016-07-06T14:17:00", "db": "BID", "id": "28999" }, { "date": "2012-06-26T00:00:00", "db": "JVNDB", "id": "JVNDB-2008-003047" }, { "date": "2008-09-05T04:00:00", "db": "NVD", "id": "CVE-2008-2170" }, { "date": "2008-09-05T00:00:00", "db": "CNNVD", "id": "CNNVD-200805-125" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-200805-125" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Century Service disruption in routers (DoS) Vulnerabilities", "sources": [ { "db": "JVNDB", "id": "JVNDB-2008-003047" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "input validation", "sources": [ { "db": "CNNVD", "id": "CNNVD-200805-125" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.