CVE-2017-2347 in Junos
Summary
by MITRE
A denial of service vulnerability in rpd daemon of Juniper Networks Junos OS allows a malformed MPLS ping packet to crash the rpd daemon if MPLS OAM is configured. Repeated crashes of the rpd daemon can result in an extended denial of service condition for the device. The affected releases are Junos OS 12.3X48 prior to 12.3X48-D50, 12.3X48-D55; 13.3 prior to 13.3R10; 14.1 prior to 14.1R4-S13, 14.1R8-S3, 14.1R9; 14.1X53 prior to 14.1X53-D42, 14.1X53-D50; 14.2 prior to 14.2R4-S8, 14.2R7-S6, 14.2R8; 15.1 prior to 15.1F2-S14, 15.1F5-S7, 15.1F6-S4, 15.1F7, 15.1R4-S7, 15.1R5-S1, 15.1R6; 15.1X49 prior to 15.1X49-D100; 15.1X53 prior to 15.1X53-D105, 15.1X53-D47, 15.1X53-D62, 15.1X53-D70; 16.1 prior to 16.1R3-S3, 16.1R4. No other Juniper Networks products or platforms are affected by this issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/01/2021
The vulnerability identified as CVE-2017-2347 represents a critical denial of service weakness within the rpd daemon of Juniper Networks Junos OS operating systems. This flaw specifically targets the routing protocol daemon responsible for handling multiprotocol label switching operations and can be exploited through malformed MPLS ping packets when MPLS OAM (Operations, Administration, and Maintenance) functionality is enabled on affected devices. The rpd daemon serves as a fundamental component in Juniper's routing infrastructure, making this vulnerability particularly dangerous as it directly impacts the core routing capabilities of network equipment.
The technical nature of this vulnerability stems from insufficient input validation within the rpd daemon's processing of MPLS ping packets. When the daemon receives malformed packets that do not conform to expected MPLS OAM packet structures, the parsing logic fails to properly handle these irregular inputs, resulting in a crash of the routing protocol daemon. This behavior aligns with CWE-121, which describes heap-based buffer overflow conditions, and represents a classic example of improper input validation leading to memory corruption. The vulnerability manifests as a direct result of the daemon's failure to implement robust error handling mechanisms when processing malformed network traffic, creating a condition where legitimate network operations can be disrupted through carefully crafted malicious packets.
The operational impact of this vulnerability extends beyond simple service interruption, as repeated exploitation can lead to sustained denial of service conditions that significantly compromise network availability. Network administrators managing Juniper devices with MPLS OAM configured face the risk of extended outages where the rpd daemon continuously crashes and requires manual intervention to restart. This creates cascading effects throughout the network infrastructure as routing information becomes unavailable, potentially affecting multiple services that depend on proper MPLS forwarding operations. The vulnerability's exploitation requires minimal network access and can be executed remotely, making it particularly attractive to threat actors seeking to disrupt network operations without requiring physical access to the devices.
Mitigation strategies for this vulnerability require immediate implementation of firmware updates to patched versions of Junos OS across all affected releases. Organizations should prioritize patching their network infrastructure, particularly devices running MPLS OAM functionality, as the vulnerability can be exploited without authentication or specialized privileges. Network segmentation and access control measures can provide temporary protection by limiting exposure to the affected MPLS OAM services, though this approach does not address the root cause. Additionally, implementing network monitoring solutions that can detect unusual patterns of MPLS ping traffic may help identify potential exploitation attempts. From an ATT&CK framework perspective, this vulnerability maps to techniques involving service stoppage and system compromise, specifically targeting network infrastructure components to achieve persistent denial of service conditions that align with the T1499.004 sub-technique for network disruption through service availability attacks. Organizations should also consider implementing intrusion detection systems that can identify malformed MPLS packets and alert administrators to potential exploitation attempts before they can cause significant disruption to network operations.