CVE-2018-0050
Last modified
CVE-2018-0050 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. An error handling vulnerability in Routing Protocols Daemon (RPD) of Juniper Networks Junos OS allows an attacker to cause RPD to crash. Continued receipt of this malformed MPLS RSVP packet will cause a sustained Denial of Service condition. EPSS estimates a 2.30% chance of exploitation in the next 30 days.
Description
An error handling vulnerability in Routing Protocols Daemon (RPD) of Juniper Networks Junos OS allows an attacker to cause RPD to crash. Continued receipt of this malformed MPLS RSVP packet will cause a sustained Denial of Service condition. Affected releases are Juniper Networks Junos OS: 14.1 versions prior to 14.1R8-S5, 14.1R9; 14.1X53 versions prior to 14.1X53-D48 on QFX Switching; 14.2 versions prior to 14.1X53-D130 on QFabric System; 14.2 versions prior to 14.2R4. This issue does not affect versions of Junos OS before 14.1R1. Junos OS RSVP only supports IPv4. IPv6 is not affected by this issue. This issue require it to be received on an interface configured to receive this type of traffic.
Metrics
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Juniper | Junos | 14.1 |
| Juniper | Junos | 14.1x53 |
| Juniper | Junos | 14.2 |
References
- http://www.securityfocus.com/bid/106206Third Party Advisory
- http://www.securitytracker.com/id/1041851Third Party Advisory, VDB Entry
- https://kb.juniper.net/JSA10884Mitigation, Vendor Advisory
- http://www.securityfocus.com/bid/106206Third Party Advisory
- http://www.securitytracker.com/id/1041851Third Party Advisory, VDB Entry
- https://kb.juniper.net/JSA10884Mitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-0050?
How severe is CVE-2018-0050?
How do I fix CVE-2018-0050?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-0044An insecure SSHD configuration in Juniper Device Manager (JD…9.8
- CVE-2018-0045Receipt of a specific Draft-Rosen MVPN control packet may ca…8.8
- CVE-2018-0046A reflected cross-site scripting vulnerability in OpenNMS in…8.8
- CVE-2018-0047A persistent cross-site scripting vulnerability in the UI fr…8
- CVE-2018-0048A vulnerability in the Routing Protocols Daemon (RPD) with J…7.5
- CVE-2018-0049A NULL Pointer Dereference vulnerability in Juniper Networks…7.5
- CVE-2018-0051A Denial of Service vulnerability in the SIP application lay…7.5
- CVE-2018-0052If RSH service is enabled on Junos OS and if the PAM authent…7.2
- CVE-2018-0053An authentication bypass vulnerability in the initial boot s…6.8
- CVE-2018-0054On QFX5000 Series and EX4600 switches, a high rate of Ethern…6.5
- CVE-2018-0055Receipt of a specially crafted DHCPv6 message destined to a …6.5
- CVE-2018-0056If a duplicate MAC address is learned by two different inter…6.5
Are you affected by CVE-2018-0050?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST
