Juniper Junos OS Evolved prior 23.2R1-S1-EVO/23.2R2-EVO Advanced Forwarding Toolkit Manager null pointer dereference
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
6.3 | $0-$5k | 0.07 |
A vulnerability has been found in Juniper Junos OS Evolved and classified as critical. This vulnerability affects an unknown function of the component Advanced Forwarding Toolkit Manager. The manipulation with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability. CVE summarizes:
A NULL Pointer Dereference vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). When Layer 2 traffic is sent through a logical interface, MAC learning happens. If during this process, the interface flaps, an Advanced Forwarding Toolkit manager (evo-aftmand-bt) core is observed. This leads to a PFE restart. The crash reoccurs if the same sequence of events happens, which will lead to a sustained DoS condition. This issue affects Juniper Networks Junos OS Evolved: 23.2-EVO versions earlier than 23.2R1-S1-EVO, 23.2R2-EVO.
The advisory is available at supportportal.juniper.net. This vulnerability was named CVE-2024-30403 since 03/26/2024. The exploitation appears to be easy. The attack needs to approached within the local network. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 04/12/2024).
Upgrading to version 23.2R1-S1-EVO or 23.2R2-EVO eliminates this vulnerability.
The entry VDB-178730 is related to this item.
Product
Type
Vendor
Name
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔒VulDB CVSS-BT Score: 🔒
VulDB Vector: 🔒
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.5VulDB Meta Temp Score: 6.3
VulDB Base Score: 6.5
VulDB Temp Score: 6.2
VulDB Vector: 🔒
VulDB Reliability: 🔍
CNA Base Score: 6.5
CNA Vector (Juniper Networks, Inc.): 🔒
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploiting
Class: Null pointer dereferenceCWE: CWE-476 / CWE-404
CAPEC: 🔒
ATT&CK: 🔒
Local: No
Remote: Partially
Availability: 🔒
Status: Not defined
EPSS Score: 🔒
EPSS Percentile: 🔒
Price Prediction: 🔍
Current Price Estimation: 🔒
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔒
Upgrade: Junos OS Evolved 23.2R1-S1-EVO/23.2R2-EVO
Timeline
03/26/2024 CVE reserved04/12/2024 Advisory disclosed
04/12/2024 VulDB entry created
05/22/2024 VulDB entry last update
Sources
Vendor: juniper.netAdvisory: JSA79181
Status: Confirmed
CVE: CVE-2024-30403 (🔒)
See also: 🔒
Entry
Created: 04/12/2024 17:48Updated: 05/22/2024 09:02
Changes: 04/12/2024 17:48 (64), 04/12/2024 17:49 (1), 05/22/2024 09:02 (1)
Complete: 🔍
Cache ID: 18:70D:103
No comments yet. Languages: en.
Please log in to comment.