CVE-2018-0034: Junos OS: A malicious crafted IPv6 DHCP packet may cause the JDHCPD daemon to core

Published Jul 11, 2018

Updated

A Denial of Service vulnerability exists in the Juniper Networks Junos OS JDHCPD daemon which allows an attacker to core the JDHCPD daemon by sending a crafted IPv6 packet to the system. This issue is limited to systems which receives IPv6 DHCP packets on a system configured for DHCP processing using the JDHCPD daemon. This issue does not affect IPv4 DHCP packet processing. Affected releases are Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S10 on EX Series; 12.3X48 versions prior to 12.3X48-D70 on SRX Series; 14.1X53 versions prior to 14.1X53-D47 on EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3500, QFX3600, QFX5100; 14.1X53 versions prior to 14.1X53-D130 on QFabric; 15.1 versions prior to 15.1R4-S9, 15.1R6-S6, 15.1R7; 15.1X49 versions prior to 15.1X49-D140 on SRX Series; 15.1X53 versions prior to 15.1X53-D67 on QFX10000 Series; 15.1X53 versions prior to 15.1X53-D233 on QFX5110, QFX5200; 15.1X53 versions prior to 15.1X53-D471 on NFX 150, NFX 250; 16.1 versions prior to 16.1R3-S9, 16.1R4-S8, 16.1R5-S4, 16.1R6-S3, 16.1R7; 16.2 versions prior to 16.2R2-S5, 16.2R3; 17.1 versions prior to 17.1R1-S7, 17.1R2-S7, 17.1R3; 17.2 versions prior to 17.2R1-S6, 17.2R2-S4, 17.2R3; 17.3 versions prior to 17.3R1-S4, 17.3R2-S2, 17.3R3; 17.4 versions prior to 17.4R1-S3, 17.4R2.

Affected Software

185 affected components

Juniper Junos=12.3

Juniper Junos=12.3-r1

Juniper Junos=12.3-r10

Juniper Junos=12.3-r11

Juniper Junos=12.3-r12

Juniper Junos=12.3-r2

Juniper Junos=12.3-r3

Juniper Junos=12.3-r4

Juniper Junos=12.3-r5

Juniper Junos=12.3-r6

Juniper Junos=12.3-r7

Juniper Junos=12.3-r8

Juniper Junos=12.3-r9

Juniper EX2200

Juniper EX2200-C

Juniper Ex2200-vc

Juniper EX3200

Juniper EX3300

Juniper Ex3300-vc

Juniper EX4200

Juniper Ex4200-vc

Juniper EX4500

Juniper Ex4500-vc

Juniper EX4550

Juniper Ex4550-vc

Juniper EX6200

Juniper EX8200

Juniper Ex8200-vc

Juniper EX9200

Juniper Junos=12.3x48

Juniper Junos=12.3x48-d10

Juniper Junos=12.3x48-d15

Juniper Junos=12.3x48-d20

Juniper Junos=12.3x48-d25

Juniper Junos=12.3x48-d30

Juniper Junos=12.3x48-d35

Juniper Junos=12.3x48-d40

Juniper Junos=12.3x48-d45

Juniper Junos=12.3x48-d50

Juniper Junos=12.3x48-d55

Juniper Junos=12.3x48-d60

Juniper Junos=12.3x48-d65

Juniper SRX100

Juniper SRX110

Juniper SRX1400

Juniper SRX210

Juniper SRX220

Juniper SRX240

Juniper SRX3400

Juniper SRX3600

Juniper SRX5400

Juniper SRX550

Juniper SRX5600

Juniper SRX5800

Juniper SRX650

Juniper Junos=14.1x53

Juniper Junos=14.1x53-d10

Juniper Junos=14.1x53-d15

Juniper Junos=14.1x53-d16

Juniper Junos=14.1x53-d20

Juniper Junos=14.1x53-d25

Juniper Junos=14.1x53-d26

Juniper Junos=14.1x53-d27

Juniper Junos=14.1x53-d30

Juniper Junos=14.1x53-d35

Juniper Junos=14.1x53-d40

Juniper Junos=14.1x53-d42

Juniper Junos=14.1x53-d43

Juniper Junos=14.1x53-d44

Juniper Junos=14.1x53-d45

Juniper Junos=14.1x53-d46

Juniper Ex2200\/vc

Juniper Ex3300\/vc

Juniper EX4300

Juniper Ex4550\/vc

Juniper EX4600

Juniper Ex8200\/vc \(xre\)

Juniper QFX3500

Juniper QFX3600

Juniper QFX5100

Juniper Junos=14.1x53-d121

Juniper Junos=14.1x53-d47

Juniper Qfx3000-g

Juniper Qfx3000-m

Juniper Junos=15.1

Juniper Junos=15.1-f2

Juniper Junos=15.1-f3

Juniper Junos=15.1-f4

Juniper Junos=15.1-f5

Juniper Junos=15.1-r1

Juniper Junos=15.1-r2

Juniper Junos=15.1-r3

Juniper Junos=15.1-r4

Juniper Junos=15.1-r6-s6

Juniper Junos=15.1-r7

Juniper Junos=15.1x49

Juniper Junos=15.1x49-d10

Juniper Junos=15.1x49-d100

Juniper Junos=15.1x49-d110

Juniper Junos=15.1x49-d120

Juniper Junos=15.1x49-d130

Juniper Junos=15.1x49-d20

Juniper Junos=15.1x49-d30

Juniper Junos=15.1x49-d35

Juniper Junos=15.1x49-d40

Juniper Junos=15.1x49-d45

Juniper Junos=15.1x49-d50

Juniper Junos=15.1x49-d60

Juniper Junos=15.1x49-d65

Juniper Junos=15.1x49-d70

Juniper Junos=15.1x49-d75

Juniper Junos=15.1x49-d80

Juniper Junos=15.1x49-d90

Juniper SRX1500

Juniper SRX300

Juniper SRX320

Juniper SRX340

Juniper SRX345

Juniper SRX4100

Juniper SRX4200

Juniper Srx550 Hm

Juniper Junos=15.1x53

Juniper Junos=15.1x53-d10

Juniper Junos=15.1x53-d20

Juniper Junos=15.1x53-d21

Juniper Junos=15.1x53-d30

Juniper Junos=15.1x53-d32

Juniper Junos=15.1x53-d33

Juniper Junos=15.1x53-d34

Juniper Junos=15.1x53-d40

Juniper Junos=15.1x53-d45

Juniper Junos=15.1x53-d50

Juniper Junos=15.1x53-d51

Juniper Junos=15.1x53-d52

Juniper Junos=15.1x53-d55

Juniper Junos=15.1x53-d56

Juniper Junos=15.1x53-d57

Juniper Junos=15.1x53-d58

Juniper Junos=15.1x53-d59

Juniper Junos=15.1x53-d60

Juniper Junos=15.1x53-d61

Juniper Junos=15.1x53-d62

Juniper Junos=15.1x53-d63

Juniper Junos=15.1x53-d64

Juniper Junos=15.1x53-d65

Juniper Junos=15.1x53-d66

Juniper QFX10002

Juniper QFX10008

Juniper QFX10016

Juniper Junos=15.1x53-d210

Juniper Junos=15.1x53-d230

Juniper Junos=15.1x53-d231

Juniper Junos=15.1x53-d232

Juniper Junos=15.1x53-d67

Juniper QFX5110

Juniper QFX5200

Juniper NFX150

Juniper NFX250

Juniper Junos=16.1

Juniper Junos=16.1-r1

Juniper Junos=16.1-r2

Juniper Junos=16.1-r3

Juniper Junos=16.1-r4-s8

Juniper Junos=16.1-r5-s4

Juniper Junos=16.1-r6-s3

Juniper Junos=16.1-r7

Juniper Junos=16.2

Juniper Junos=16.2-r1

Juniper Junos=16.2-r2

Juniper Junos=16.2-r3

Juniper Junos=17.1

Juniper Junos=17.1-r1

Juniper Junos=17.1-r2-s7

Juniper Junos=17.1-r3

Juniper Junos=17.2

Juniper Junos=17.2-r1

Juniper Junos=17.2-r2-s4

Juniper Junos=17.2-r3

Juniper Junos=17.3

Juniper Junos=17.3-r1

Juniper Junos=17.3-r2-s2

Juniper Junos=17.3-r3

Juniper Junos=17.4

Juniper Junos=17.4-r1

Juniper Junos=17.4-r2

Remediation

Information

The following software releases have been updated to resolve this specific issue: Junos OS 12.3R12-S10, 12.3X48-D70, 14.1X53-D130*, 14.1X53-D47, 15.1R4-S9, 15.1R6-S6, 15.1R7, 15.1X49-D140, 15.1X53-D233, 15.1X53-D471, 15.1X53-D67, 16.1R3-S9, 16.1R4-S8, 16.1R5-S4, 16.1R6-S3, 16.1R7, 16.2R2-S5, 16.2R3, 17.1R1-S7, 17.1R2-S7, 17.1R3, 17.2R1-S6, 17.2R2-S4, 17.2R3, 17.3R1-S4, 17.3R2-S2, 17.3R3, 17.4R1-S3, 17.4R2, 18.1R1, and all subsequent releases. *Pending Publication

Event History

Jul 11, 2018

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2018-0034?

CVE-2018-0034 has been classified as a moderate severity Denial of Service vulnerability.

How do I fix CVE-2018-0034?

To fix CVE-2018-0034, upgrade the Junos OS to a version that is not affected by this vulnerability.

What products are affected by CVE-2018-0034?

CVE-2018-0034 affects specific versions of Junos OS, particularly those in the 12.3 series and select 14.x and 15.x versions.

Can CVE-2018-0034 be exploited remotely?

Yes, CVE-2018-0034 can be exploited remotely by sending a crafted IPv6 packet.

Is there a workaround for CVE-2018-0034?

There is no official workaround for CVE-2018-0034; upgrading to a patched version is recommended.