CVE-2024-39530

An Improper Check for Unusual or Exceptional Conditions vulnerability in the chassis management daemon (chassisd) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If an attempt is made to access specific sensors on platforms not supporting these sensors, either via GRPC or netconf, chassisd will crash and restart leading to a restart of all FPCs and thereby a complete outage. This issue affects Junos OS: * 21.4 versions from 21.4R3 before 21.4R3-S5, * 22.1 versions from 22.1R3 before 22.1R3-S4, * 22.2 versions from 22.2R2 before 22.2R3, * 22.3 versions from 22.3R1 before 22.3R2-S2, 22.3R3, * 22.4 versions from 22.4R1 before 22.4R2. This issue does not affect Junos OS versions earlier than 21.4.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://supportportal.juniper.net/JSA82989	Vendor Advisory
https://supportportal.juniper.net/JSA82989	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:juniper:junos:21.4:r3::::::
	cpe:2.3:o:juniper:junos:21.4:r3-s1::::::
	cpe:2.3:o:juniper:junos:21.4:r3-s2::::::
	cpe:2.3:o:juniper:junos:21.4:r3-s3::::::
	cpe:2.3:o:juniper:junos:21.4:r3-s4::::::

Configuration 2 (hide)

OR	cpe:2.3:o:juniper:junos:21.1:r3::::::
	cpe:2.3:o:juniper:junos:21.1:r3-s1::::::
	cpe:2.3:o:juniper:junos:21.1:r3-s2::::::
	cpe:2.3:o:juniper:junos:21.1:r3-s3::::::

Configuration 3 (hide)

OR	cpe:2.3:o:juniper:junos:22.2:r2::::::
	cpe:2.3:o:juniper:junos:22.2:r2-s1::::::
	cpe:2.3:o:juniper:junos:22.2:r2-s2::::::

Configuration 4 (hide)

OR	cpe:2.3:o:juniper:junos:22.3:r1::::::
	cpe:2.3:o:juniper:junos:22.3:r1-s1::::::
	cpe:2.3:o:juniper:junos:22.3:r1-s2::::::
	cpe:2.3:o:juniper:junos:22.3:r2::::::
	cpe:2.3:o:juniper:junos:22.3:r2-s1::::::

Configuration 5 (hide)

OR	cpe:2.3:o:juniper:junos:22.4:r1::::::
	cpe:2.3:o:juniper:junos:22.4:r1-s1::::::
	cpe:2.3:o:juniper:junos:22.4:r1-s2::::::

History

21 Nov 2024, 09:27

Type	Values Removed	Values Added
References	~~() https://supportportal.juniper.net/JSA82989 - Vendor Advisory~~	() https://supportportal.juniper.net/JSA82989 - Vendor Advisory

23 Sep 2024, 14:13

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de verificación inadecuada de condiciones inusuales o excepcionales en el daemon de administración de chassis (chassisd) de Juniper Networks Junos OS permite que un atacante no autenticado basado en la red provoque una denegación de servicio (DoS). Si se intenta acceder a sensores específicos en plataformas que no admiten estos sensores, ya sea a través de GRPC o netconf, chasisd fallará y se reiniciará, lo que provocará un reinicio de todos los FPC y, por lo tanto, una interrupción completa. Este problema afecta a Junos OS: * versiones 21.4 desde 21.4R3 anteriores a 21.4R3-S5, * versiones 22.1 desde 22.1R3 anteriores a 22.1R3-S4, * versiones 22.2 desde 22.2R2 anteriores a 22.2R3, * versiones 22.3 desde 22.3R1 anteriores a 22.3R2- Versiones S2, 22.3R3, * 22.4 desde 22.4R1 antes de 22.4R2. Este problema no afecta a las versiones de Junos OS anteriores a la 21.4.
CPE		cpe:2.3:o:juniper:junos:22.3:r1:::::: cpe:2.3:o:juniper:junos:22.3:r1-s2:::::: cpe:2.3:o:juniper:junos:21.1:r3-s2:::::: cpe:2.3:o:juniper:junos:22.2:r2:::::: cpe:2.3:o:juniper:junos:22.2:r2-s2:::::: cpe:2.3:o:juniper:junos:22.3:r1-s1:::::: cpe:2.3:o:juniper:junos:21.1:r3-s1:::::: cpe:2.3:o:juniper:junos:21.4:r3-s3:::::: cpe:2.3:o:juniper:junos:22.3:r2-s1:::::: cpe:2.3:o:juniper:junos:22.4:r1-s1:::::: cpe:2.3:o:juniper:junos:21.4:r3-s2:::::: cpe:2.3:o:juniper:junos:22.4:r1:::::: cpe:2.3:o:juniper:junos:21.4:r3-s4:::::: cpe:2.3:o:juniper:junos:21.4:r3:::::: cpe:2.3:o:juniper:junos:22.2:r2-s1:::::: cpe:2.3:o:juniper:junos:22.4:r1-s2:::::: cpe:2.3:o:juniper:junos:21.4:r3-s1:::::: cpe:2.3:o:juniper:junos:22.3:r2:::::: cpe:2.3:o:juniper:junos:21.1:r3:::::: cpe:2.3:o:juniper:junos:21.1:r3-s3::::::
References	~~() https://supportportal.juniper.net/JSA82989 -~~	() https://supportportal.juniper.net/JSA82989 - Vendor Advisory
First Time		Juniper junos Juniper

11 Jul 2024, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-11 16:15

Updated : 2024-11-21 09:27

NVD link : CVE-2024-39530

Mitre link : CVE-2024-39530

CVE.ORG link : CVE-2024-39530

JSON object : View

Products Affected

juniper

junos

CWE

CWE-754

Improper Check for Unusual or Exceptional Conditions

{"id": "CVE-2024-39530", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "sirt@juniper.net", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "sirt@juniper.net", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 8.7, "automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "NONE", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "LOW", "vulnerableSystemAvailability": "HIGH", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "NONE", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-07-11T16:15:04.613", "references": [{"url": "https://supportportal.juniper.net/JSA82989", "tags": ["Vendor Advisory"], "source": "sirt@juniper.net"}, {"url": "https://supportportal.juniper.net/JSA82989", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "sirt@juniper.net", "description": [{"lang": "en", "value": "CWE-754"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-754"}]}], "descriptions": [{"lang": "en", "value": "An Improper Check for Unusual or Exceptional Conditions vulnerability in the chassis management daemon (chassisd) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause a \n\nDenial-of-Service (DoS).\n\nIf an attempt is made to access specific sensors on platforms not supporting these sensors, either via GRPC or netconf, chassisd will crash and restart leading to a restart of all FPCs and thereby a complete outage.\n\nThis issue affects Junos OS:\n\n\n\n * 21.4 versions from 21.4R3 before 21.4R3-S5,\n * 22.1 versions from 22.1R3 before 22.1R3-S4,\n * 22.2 versions from 22.2R2 before 22.2R3,\n * 22.3 versions from 22.3R1 before 22.3R2-S2, 22.3R3,\n * 22.4 versions from 22.4R1 before 22.4R2.\n\n\nThis issue does not affect Junos OS versions earlier than 21.4."}, {"lang": "es", "value": "Una vulnerabilidad de verificaci\u00f3n inadecuada de condiciones inusuales o excepcionales en el daemon de administraci\u00f3n de chassis (chassisd) de Juniper Networks Junos OS permite que un atacante no autenticado basado en la red provoque una denegaci\u00f3n de servicio (DoS). Si se intenta acceder a sensores espec\u00edficos en plataformas que no admiten estos sensores, ya sea a trav\u00e9s de GRPC o netconf, chasisd fallar\u00e1 y se reiniciar\u00e1, lo que provocar\u00e1 un reinicio de todos los FPC y, por lo tanto, una interrupci\u00f3n completa. Este problema afecta a Junos OS: * versiones 21.4 desde 21.4R3 anteriores a 21.4R3-S5, * versiones 22.1 desde 22.1R3 anteriores a 22.1R3-S4, * versiones 22.2 desde 22.2R2 anteriores a 22.2R3, * versiones 22.3 desde 22.3R1 anteriores a 22.3R2- Versiones S2, 22.3R3, * 22.4 desde 22.4R1 antes de 22.4R2. Este problema no afecta a las versiones de Junos OS anteriores a la 21.4."}], "lastModified": "2024-11-21T09:27:56.513", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:21.4:r3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CB280D8-C5D8-4B51-A879-496ACCDE4538"}, {"criteria": "cpe:2.3:o:juniper:junos:21.4:r3-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F3F54F1-75B3-400D-A735-2C27C8CEBE79"}, {"criteria": "cpe:2.3:o:juniper:junos:21.4:r3-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "476A49E7-37E9-40F9-BF2D-9BBFFAA1DFFC"}, {"criteria": "cpe:2.3:o:juniper:junos:21.4:r3-s3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A5B196A-2AF1-4AE5-9148-A75A572807BC"}, {"criteria": "cpe:2.3:o:juniper:junos:21.4:r3-s4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B457616-2D91-4913-9A7D-038BBF8F1F66"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:21.1:r3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0040FE2-7ECD-4755-96CE-E899BA298E0C"}, {"criteria": "cpe:2.3:o:juniper:junos:21.1:r3-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "076AB086-BB79-4583-AAF7-A5233DFB2F95"}, {"criteria": "cpe:2.3:o:juniper:junos:21.1:r3-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "72E2DDF6-01DF-4880-AB60-B3DA3281E88D"}, {"criteria": "cpe:2.3:o:juniper:junos:21.1:r3-s3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54010163-0810-4CF5-95FE-7E62BC6CA4F9"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:22.2:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E37D4694-C80B-475E-AB5B-BB431F59C5E1"}, {"criteria": "cpe:2.3:o:juniper:junos:22.2:r2-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5EC0D2D2-4922-4675-8A2C-57A08D7BE334"}, {"criteria": "cpe:2.3:o:juniper:junos:22.2:r2-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EC91F9D-DEDA-46B4-A39F-59A2CDB86C2E"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:22.3:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "19519212-51DD-4448-B115-8A20A40192CC"}, {"criteria": "cpe:2.3:o:juniper:junos:22.3:r1-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5CC9909E-AE9F-414D-99B1-83AA04D5297B"}, {"criteria": "cpe:2.3:o:juniper:junos:22.3:r1-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FDE9E767-4713-4EA2-8D00-1382975A4A15"}, {"criteria": "cpe:2.3:o:juniper:junos:22.3:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59DDA54E-6845-47EB-AE3C-5EC6BD33DFA7"}, {"criteria": "cpe:2.3:o:juniper:junos:22.3:r2-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "574730B0-56C8-4A03-867B-1737148ED9B1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "28E42A41-7965-456B-B0AF-9D3229CE4D4C"}, {"criteria": "cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB1A77D6-D3AD-481B-979C-8F778530B175"}, {"criteria": "cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A064B6B-A99B-4D8D-A62D-B00C7870BC30"}], "operator": "OR"}]}], "sourceIdentifier": "sirt@juniper.net"}

7.5 /10