CVE-2018-0006 - Junos OS: bbe-smgd process denial of service while processing VLAN authentication requests/rejects

Back Back to CVE browser

MEDIUM

Junos OS: bbe-smgd process denial of service while processing VLAN authentication requests/rejects

Published Jan 10, 2018

6.5

MEDIUM

CVSS 3.0

EPSS 0.67%

Description

A high rate of VLAN authentication attempts sent from an adjacent host on the local broadcast domain can trigger high memory utilization by the BBE subscriber management daemon (bbe-smgd), and lead to a denial of service condition. The issue was caused by attempting to process an unbounded number of pending VLAN authentication requests, leading to excessive memory allocation. This issue only affects devices configured for DHCPv4/v6 over AE auto-sensed VLANs, utilized in Broadband Edge (BBE) deployments. Other configurations are unaffected by this issue. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1R6-S2, 15.1R7; 16.1 versions prior to 16.1R5-S1, 16.1R6; 16.2 versions prior to 16.2R2-S2, 16.2R3; 17.1 versions prior to 17.1R2-S5, 17.1R3; 17.2 versions prior to 17.2R2.

Affected products

Vendor Juniper Networks Product Junos OS Default
n/a
- Version
  15.1
  Status
  affected
  Constraints
  <15.1R6-S2, 15.1R7
- Version
  16.1
  Status
  affected
  Constraints
  <16.1R5-S1, 16.1R6
- Version
  16.2
  Status
  affected
  Constraints
  <16.2R2-S2, 16.2R3
- Version
  17.1
  Status
  affected
  Constraints
  <17.1R2-S5, 17.1R3
- Version
  17.2
  Status
  affected
  Constraints
  <17.2R2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Juniper Networks

Junos OS

n/a

Version	Status	Constraints
15.1	affected	<15.1R6-S2, 15.1R7
16.1	affected	<16.1R5-S1, 16.1R6
16.2	affected	<16.2R2-S2, 16.2R3
17.1	affected	<17.1R2-S5, 17.1R3
17.2	affected	<17.2R2

Remediation

Vendor solution

The following software releases have been updated to resolve this specific issue: 15.1R6-S2, 15.1R7, 16.1R5-S1, 16.1R6, 16.2R2-S2, 16.2R3, 17.1R2-S5*, 17.1R3*, 17.2R2, 17.3R1, 17.4R1, and all subsequent releases.

*pending release

Weaknesses (1)

CWE-770

Allocation of Resources Without Limits

References (3)

http://www.securitytracker.com/id/1040184
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0831
Advisory
https://kb.juniper.net/JSA10834
x_refsource_CONFIRMMitigationPatchVendor Advisory

Link	Providers	Tags
http://www.securitytracker.com/id/1040184		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0831		Advisory
https://kb.juniper.net/JSA10834		x_refsource_CONFIRMMitigationPatchVendor Advisory