Details of VAR-201307-0476

ID

VAR-201307-0476

CVE

CVE-2013-4686

TITLE

Juniper Junos Service disruption in some kernels (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2013-003333

DESCRIPTION

The kernel in Juniper Junos 10.4 before 10.4R14, 11.4 before 11.4R8, 11.4X27 before 11.4X27.43, 12.1 before 12.1R6, 12.1X44 before 12.1X44-D20, 12.2 before 12.2R4, and 12.3 before 12.3R2, in certain VLAN configurations with unrestricted arp-resp and proxy-arp settings, allows remote attackers to cause a denial of service (device crash) via a crafted ARP request, aka PR 842091. Juniper Networks Junos is prone to multiple denial-of-service vulnerabilities. Attackers can exploit these issues to cause the host system to crash, resulting in a denial-of-service condition. Junos 10.4, 11.4, 11.4X27, 12.1X44, 12.1, 12.2 and 12.3 are vulnerable. The operating system provides a secure programming interface and Junos SDK. Juniper Junos 10.4 before 10.4R14, 11.4 before 11.4R8, 11.4X27 before 11.4X27.43, 12.1 before 12.1R6, 12.1X44 before 12.1X44-D20, 12.2 before 12.2R4, There is a denial of service vulnerability in the 12.3 kernel before 12.3R2. The vulnerability stems from the lack of restrictions on the settings of arp-resp and proxy-arp in the VLAN configuration of the program

Trust: 1.98

sources: NVD: CVE-2013-4686 // JVNDB: JVNDB-2013-003333 // BID: 61126 // VULHUB: VHN-64688

AFFECTED PRODUCTS

vendor:	juniper	model:	junos	scope:	eq	version:	12.3	Trust: 1.9
vendor:	juniper	model:	junos	scope:	eq	version:	12.2	Trust: 1.9
vendor:	juniper	model:	junos	scope:	eq	version:	12.1x44	Trust: 1.9
vendor:	juniper	model:	junos	scope:	eq	version:	12.1	Trust: 1.9
vendor:	juniper	model:	junos	scope:	eq	version:	11.4x27	Trust: 1.9
vendor:	juniper	model:	junos	scope:	eq	version:	11.4	Trust: 1.9
vendor:	juniper	model:	junos	scope:	eq	version:	10.4	Trust: 1.9
vendor:	juniper	model:	junos os	scope:	eq	version:	12.2r4	Trust: 0.8
vendor:	juniper	model:	junos os	scope:	lt	version:	12.3	Trust: 0.8
vendor:	juniper	model:	junos os	scope:	eq	version:	12.1r6	Trust: 0.8
vendor:	juniper	model:	junos os	scope:	eq	version:	12.3r2	Trust: 0.8
vendor:	juniper	model:	junos os	scope:	lt	version:	12.1x44	Trust: 0.8
vendor:	juniper	model:	junos os	scope:	lt	version:	10.4	Trust: 0.8
vendor:	juniper	model:	junos os	scope:	eq	version:	11.4r8	Trust: 0.8
vendor:	juniper	model:	junos os	scope:	lt	version:	12.1	Trust: 0.8
vendor:	juniper	model:	junos os	scope:	lt	version:	12.2	Trust: 0.8
vendor:	juniper	model:	junos os	scope:	eq	version:	12.1x44-d20	Trust: 0.8
vendor:	juniper	model:	junos os	scope:	lt	version:	11.4	Trust: 0.8
vendor:	juniper	model:	junos os	scope:	lt	version:	11.4x27	Trust: 0.8
vendor:	juniper	model:	junos os	scope:	eq	version:	11.4x27.43	Trust: 0.8
vendor:	juniper	model:	junos os	scope:	eq	version:	10.4r14	Trust: 0.8
vendor:	juniper	model:	junos 13.1r1	scope:	ne	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 12.3r2	scope:	ne	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 12.2r4	scope:	ne	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 12.1x44-d20	scope:	ne	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 12.1r6	scope:	ne	version:	-	Trust: 0.3
vendor:	juniper	model:	junos	scope:	ne	version:	11.4x27.43	Trust: 0.3
vendor:	juniper	model:	junos 11.4r8	scope:	ne	version:	-	Trust: 0.3
vendor:	juniper	model:	junos 10.4r14	scope:	ne	version:	-	Trust: 0.3

sources: BID: 61126 // JVNDB: JVNDB-2013-003333 // CNNVD: CNNVD-201307-230 // NVD: CVE-2013-4686

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2013-4686
value:	HIGH
Trust: 1.0
NVD:	CVE-2013-4686
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201307-230
value:	HIGH
Trust: 0.6
VULHUB:	VHN-64688
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2013-4686
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-64688
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-64688 // JVNDB: JVNDB-2013-003333 // CNNVD: CNNVD-201307-230 // NVD: CVE-2013-4686

PROBLEMTYPE DATA

problemtype:

NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2013-4686

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201307-230

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201307-230

CONFIGURATIONS

sources: JVNDB: JVNDB-2013-003333

PATCH

title:

JSA10576

url:

http://kb.juniper.net/JSA10576

Trust: 0.8

sources: JVNDB: JVNDB-2013-003333

EXTERNAL IDS

db:	NVD	id:	CVE-2013-4686	Trust: 2.8
db:	JUNIPER	id:	JSA10576	Trust: 2.0
db:	BID	id:	61126	Trust: 1.4
db:	SECUNIA	id:	54119	Trust: 1.1
db:	JVNDB	id:	JVNDB-2013-003333	Trust: 0.8
db:	CNNVD	id:	CNNVD-201307-230	Trust: 0.7
db:	VULHUB	id:	VHN-64688	Trust: 0.1

sources: VULHUB: VHN-64688 // BID: 61126 // JVNDB: JVNDB-2013-003333 // CNNVD: CNNVD-201307-230 // NVD: CVE-2013-4686

REFERENCES

url:	http://kb.juniper.net/jsa10576	Trust: 1.7
url:	http://www.securityfocus.com/bid/61126	Trust: 1.1
url:	http://secunia.com/advisories/54119	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-4686	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-4686	Trust: 0.8
url:	http://www.juniper.net/	Trust: 0.3
url:	http://kb.juniper.net/infocenter/index?page=content&id=jsa10576	Trust: 0.3

sources: VULHUB: VHN-64688 // BID: 61126 // JVNDB: JVNDB-2013-003333 // CNNVD: CNNVD-201307-230 // NVD: CVE-2013-4686

CREDITS

The vendor reported these issues.

Trust: 0.3

sources: BID: 61126

SOURCES

db:	VULHUB	id:	VHN-64688
db:	BID	id:	61126
db:	JVNDB	id:	JVNDB-2013-003333
db:	CNNVD	id:	CNNVD-201307-230
db:	NVD	id:	CVE-2013-4686

LAST UPDATE DATE

2025-04-11T22:55:56.987000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-64688	date:	2013-08-22T00:00:00
db:	BID	id:	61126	date:	2013-07-11T00:00:00
db:	JVNDB	id:	JVNDB-2013-003333	date:	2013-07-16T00:00:00
db:	CNNVD	id:	CNNVD-201307-230	date:	2013-07-12T00:00:00
db:	NVD	id:	CVE-2013-4686	date:	2025-04-11T00:51:21.963

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-64688	date:	2013-07-11T00:00:00
db:	BID	id:	61126	date:	2013-07-11T00:00:00
db:	JVNDB	id:	JVNDB-2013-003333	date:	2013-07-16T00:00:00
db:	CNNVD	id:	CNNVD-201307-230	date:	2013-07-12T00:00:00
db:	NVD	id:	CVE-2013-4686	date:	2013-07-11T14:55:01.367