CVE-2024-39553

An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to send arbitrary data to the device, which leads msvcsd process to crash with limited availability impacting Denial of Service (DoS) and allows unauthorized network access to the device, potentially impacting system integrity. This issue only happens when inline jflow is configured. This does not impact any forwarding traffic. The impacted services MSVCS-DB app crashes momentarily and recovers by itself. This issue affects Juniper Networks Junos OS Evolved: * 21.4 versions earlier than 21.4R3-S7-EVO; * 22.2 versions earlier than 22.2R3-S3-EVO; * 22.3 versions earlier than 22.3R3-S2-EVO; * 22.4 versions earlier than 22.4R3-EVO; * 23.2 versions earlier than 23.2R1-S2-EVO, 23.2R2-EVO.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://supportportal.juniper.net/JSA79101
https://supportportal.juniper.net/JSA79101

Configurations

No configuration.

History

21 Nov 2024, 09:27

Type	Values Removed	Values Added
References	~~() https://supportportal.juniper.net/JSA79101 -~~	() https://supportportal.juniper.net/JSA79101 -
Summary		(es) Una vulnerabilidad de exposición de recursos a una esfera incorrecta en el servicio de muestreo de Juniper Networks Junos OS Evolved permite que un atacante basado en red no autenticado envíe datos arbitrarios al dispositivo, lo que provoca que el proceso msvcsd falle con disponibilidad limitada, lo que afecta la denegación de servicio (DoS) y permite el acceso no autorizado a la red al dispositivo, lo que podría afectar la integridad del sistema. Este problema solo ocurre cuando se configura jflow en línea. Esto no afecta el tráfico de reenvío. La aplicación MSVCS-DB de servicios afectados falla momentáneamente y se recupera por sí sola. Este problema afecta a Juniper Networks Junos OS Evolved: * Versiones 21.4 anteriores a 21.4R3-S7-EVO; * Versiones 22.2 anteriores a 22.2R3-S3-EVO; * Versiones 22.3 anteriores a 22.3R3-S2-EVO; * Versiones 22.4 anteriores a 22.4R3-EVO; * Versiones 23.2 anteriores a 23.2R1-S2-EVO, 23.2R2-EVO.

11 Jul 2024, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-11 17:15

Updated : 2024-11-21 09:27

NVD link : CVE-2024-39553

Mitre link : CVE-2024-39553

CVE.ORG link : CVE-2024-39553

JSON object : View

Products Affected

No product.

CWE

CWE-668

Exposure of Resource to Wrong Sphere

6.5 /10