CVE-2013-6014: Infoleak

Published Oct 28, 2013

Updated

Juniper Junos 10.4 before 10.4S15, 11.4 before 11.4R9, 11.4X27 before 11.4X27.44, 12.1 before 12.1R7, 12.1X44 before 12.1X44-D20, 12.1X45 before 12.1X45-D15, 12.2 before 12.2R6, 12.3 before 12.3R3, 13.1 before 13.1R3, and 13.2 before 13.2R1, when Proxy ARP is enabled on an unnumbered interface, allows remote attackers to perform ARP poisoning attacks and possibly obtain sensitive information via a crafted ARP message.

Affected Software

10 affected components

Juniper Junos=10.4

Juniper Junos=11.4

Juniper Junos=11.4x27

Juniper Junos=12.1

Juniper Junos=12.1x44

Juniper Junos=12.1x45

Juniper Junos=12.2

Juniper Junos=12.3

Juniper Junos=13.1

Juniper Junos=13.2

Event History

Oct 28, 2013

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-6014?

CVE-2013-6014 has a medium severity rating, indicating potential risk but likely limited impact.

How do I fix CVE-2013-6014?

To fix CVE-2013-6014, upgrade to the latest Junos versions specified in the advisory that patch this vulnerability.

What systems are affected by CVE-2013-6014?

CVE-2013-6014 affects several versions of Juniper Junos, specifically versions before 10.4S15, 11.4R9, 12.1R7, and others.

What is Proxy ARP in the context of CVE-2013-6014?

Proxy ARP is a method used to allow a device to respond to ARP requests on behalf of another device, which can be exploited in this vulnerability.

Are there any mitigations for CVE-2013-6014?

Disabling Proxy ARP on unnumbered interfaces can serve as a mitigation strategy for CVE-2013-6014 until a patch is applied.