CVE-2016-1260 : Juniper Junos OS before 13.2X51-D36, 14.1X53 before 14.1X53-D25, and 15.2 before

Juniper Junos OS before 13.2X51-D36, 14.1X53 before 14.1X53-D25, and 15.2 before 15.2R1 on EX4300 series switches allow remote attackers to cause a denial of service (network loop and bandwidth consumption) via unspecified vectors related to Spanning Tree Protocol (STP) traffic.

Published 2016-01-15 19:59:08

Updated 2016-12-03 03:20:07

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2016-1260

Juniper » Junos » Version: 13.2x51 Update D15
cpe:2.3:o:juniper:junos:13.2x51:d15:*:*:*:*:*:*
Matching versions
Juniper » Junos » Version: 13.2x51 Update D20
cpe:2.3:o:juniper:junos:13.2x51:d20:*:*:*:*:*:*
Matching versions
Juniper » Junos » Version: 13.2x51 Update D25
cpe:2.3:o:juniper:junos:13.2x51:d25:*:*:*:*:*:*
Matching versions
Juniper » Junos » Version: 14.1x53
cpe:2.3:o:juniper:junos:14.1x53:*:*:*:*:*:*:*
Matching versions
Juniper » Junos » Version: 13.2x51 Update D21
cpe:2.3:o:juniper:junos:13.2x51:d21:*:*:*:*:*:*
Matching versions
Juniper » Junos » Version: 13.2x51 Update D35
cpe:2.3:o:juniper:junos:13.2x51:d35:*:*:*:*:*:*
Matching versions
Juniper » Junos » Version: 14.1x53 Update R1
cpe:2.3:o:juniper:junos:14.1x53:r1:*:*:*:*:*:*
Matching versions
Juniper » Junos » Version: 13.2x51 Update D30
cpe:2.3:o:juniper:junos:13.2x51:d30:*:*:*:*:*:*
Matching versions
Juniper » Junos » Version: 13.2x51 Update D26
cpe:2.3:o:juniper:junos:13.2x51:d26:*:*:*:*:*:*
Matching versions
Juniper » Junos » Version: 14.1x53 Update D16
cpe:2.3:o:juniper:junos:14.1x53:d16:*:*:*:*:*:*
Matching versions
Juniper » Junos » Version: 14.1x53 Update D10
cpe:2.3:o:juniper:junos:14.1x53:d10:*:*:*:*:*:*
Matching versions
Juniper » Junos » Version: 15.2
cpe:2.3:o:juniper:junos:15.2:*:*:*:*:*:*:*
Matching versions
Juniper » Junos » Version: 14.1x53 Update D25
cpe:2.3:o:juniper:junos:14.1x53:d25:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2016-1260

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 56 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-1260

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
5.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low

CWE ids for CVE-2016-1260

CWE-399

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-1260

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10719

Juniper Networks - 2016-01 Security Bulletin: Junos: EX4300 Series denial of service due to artificial loop in network topology (CVE-2016-1260)
Vendor Advisory
http://www.securitytracker.com/id/1035106

Juniper Junos Network Topology Loop Lets Remote Users Consume Excessive Bandwidth on the Target System - SecurityTracker

Jump to

Vulnerability Details : CVE-2016-1260

Products affected by CVE-2016-1260

Exploit prediction scoring system (EPSS) score for CVE-2016-1260

CVSS scores for CVE-2016-1260

CWE ids for CVE-2016-1260

References for CVE-2016-1260