CVE-2023-22408 — Improper Validation of Array Index in Juniper Junos

CWE-129 — Improper Validation of Array Index4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.3%
top 47.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Juniper Junos
Timeline
PublishedJan 13

Description

An Improper Validation of Array Index vulnerability in the SIP ALG of Juniper Networks Junos OS on SRX 5000 Series allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). When an attacker sends an SIP packets with a malformed SDP field then the SIP ALG can not process it which will lead to an FPC crash and restart. Continued receipt of these specific packets will lead to a sustained Denial of Service. This issue can only occur when both below mentioned conditions are…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDjuniper/junos8 versions+7

🔴Vulnerability Details

2
GHSA
GHSA-4w9j-m79h-8w8m: An Improper Validation of Array Index vulnerability in the SIP ALG of Juniper Networks Junos OS on SRX 5000 Series allows a network-based, unauthentic↗2023-01-13
▶
CVEList
Junos OS: SRX 5000 Series: Upon processing of a specific SIP packet an FPC can crash↗2023-01-12
▶

📋Vendor Advisories

1
Juniper
CVE-2023-22408: An Improper Validation of Array Index vulnerability in the SIP ALG of Juniper Networks Junos OS on SRX 5000 Series allows a network-based, unauthentic↗2023-01-13
▶
CVE-2023-22408 — Improper Validation of Array Index | cvebase