CVE-2017-2304 — Sensitive Information Exposure in Juniper Junos

CWE-200 — Sensitive Information Exposure3 documents3 sources
Severity
7.5HIGHNVD
EPSS
1.0%
top 23.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Juniper JunosJuniper Junos OSJuniper QFX Series
Timeline
PublishedMay 30
Latest updateMay 14

Description

Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices running Junos OS 14.1X53 prior to 14.1X53-D40, 15.1X53 prior to 15.1X53-D40, 15.1 prior to 15.1R2, do not pad Ethernet packets with zeros, and thus some packets can contain fragments of system memory or data from previous packets. This issue is also known as 'Etherleak'

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDjuniper/junos14.1x53, 15.1, 15.1x53+2

🔴Vulnerability Details

1
GHSA
GHSA-2wf6-7ffx-gx7r: Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices running Junos OS 14↗2022-05-14
▶

📋Vendor Advisories

1
Juniper
CVE-2017-2304: Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices running Junos OS 14.1X53 prior to 14.1X53-D40, 15.1X53 prior to 15.1X53↗2017-05-30
▶