CVE-2017-2304 : Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices r

Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices running Junos OS 14.1X53 prior to 14.1X53-D40, 15.1X53 prior to 15.1X53-D40, 15.1 prior to 15.1R2, do not pad Ethernet packets with zeros, and thus some packets can contain fragments of system memory or data from previous packets. This issue is also known as 'Etherleak'

Published 2017-05-30 14:29:01

Updated 2019-05-10 14:11:58

Source Juniper Networks, Inc.

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2017-2304

Juniper » Junos » Version: 14.1x53
cpe:2.3:o:juniper:junos:14.1x53:-:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 15.1
cpe:2.3:o:juniper:junos:15.1:-:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 15.1 Update R1
cpe:2.3:o:juniper:junos:15.1:r1:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 14.1x53 Update D16
cpe:2.3:o:juniper:junos:14.1x53:d16:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 14.1x53 Update D10
cpe:2.3:o:juniper:junos:14.1x53:d10:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 14.1x53 Update D25
cpe:2.3:o:juniper:junos:14.1x53:d25:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 14.1x53 Update D26
cpe:2.3:o:juniper:junos:14.1x53:d26:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 14.1x53 Update D15
cpe:2.3:o:juniper:junos:14.1x53:d15:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 14.1x53 Update D27
cpe:2.3:o:juniper:junos:14.1x53:d27:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 14.1x53 Update D30
cpe:2.3:o:juniper:junos:14.1x53:d30:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 14.1x53 Update D35
cpe:2.3:o:juniper:junos:14.1x53:d35:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 15.1x53 Update D34
cpe:2.3:o:juniper:junos:15.1x53:d34:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 15.1x53 Update D33
cpe:2.3:o:juniper:junos:15.1x53:d33:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 15.1x53 Update D32
cpe:2.3:o:juniper:junos:15.1x53:d32:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 15.1x53 Update D30
cpe:2.3:o:juniper:junos:15.1x53:d30:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 15.1x53 Update D21
cpe:2.3:o:juniper:junos:15.1x53:d21:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 15.1x53 Update D20
cpe:2.3:o:juniper:junos:15.1x53:d20:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 15.1x53 Update D25
cpe:2.3:o:juniper:junos:15.1x53:d25:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 15.1x53
cpe:2.3:o:juniper:junos:15.1x53:-:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Ex4300 » Version: N/A
When used together with: Juniper » Ex4600 » Version: N/A
When used together with: Juniper » Qfx3500 » Version: N/A
When used together with: Juniper » Qfx3600 » Version: N/A
When used together with: Juniper » Qfx5100 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2017-2304

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 56 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-2304

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2017-2304

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-2304

https://kb.juniper.net/JSA10773

Juniper Networks - 2017-01 Security Bulletin: QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600: 'Etherleak' memory disclosure in Ethernet padding data (CVE-2017-2304)
Vendor Advisory
http://www.securityfocus.com/bid/95403

Multiple Juniper Products Ethernet Packet CVE-2017-2304 Information Disclosure Vulnerability
Third Party Advisory;VDB Entry
http://www.securitytracker.com/id/1037593

Juniper Junos Ethernet Frame Padding Flaw Lets Remote Users Obtain Potentially Sensitive Information on the Target System - SecurityTracker
Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2017-2304

Products affected by CVE-2017-2304

Exploit prediction scoring system (EPSS) score for CVE-2017-2304

CVSS scores for CVE-2017-2304

CWE ids for CVE-2017-2304

References for CVE-2017-2304