CVE-2017-2321

A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unprivileged, network-based attacker to cause various system services partial to full denials of services, modification of system states and files, and potential disclosure of sensitive information which may assist the attacker in further attacks on the system through the use of multiple attack vectors, including man-in-the-middle attacks, file injections, and malicious execution of commands causing out of bound memory conditions leading to other attacks.

CVSS v3 8.6 HIGH
CVSS v2.0 7.5 HIGH

8.6^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/97693	Third Party Advisory VDB Entry
https://kb.juniper.net/JSA10783	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:juniper:northstar_controller:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-04-24 15:59

Updated : 2019-10-03 00:03

NVD link : CVE-2017-2321

Mitre link : CVE-2017-2321

CVE.ORG link : CVE-2017-2321

JSON object : View

Products Affected

juniper

northstar_controller

CWE

NVD-CWE-noinfo

{"id": "CVE-2017-2321", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "published": "2017-04-24T15:59:00.473", "references": [{"url": "http://www.securityfocus.com/bid/97693", "tags": ["Third Party Advisory", "VDB Entry"], "source": "sirt@juniper.net"}, {"url": "https://kb.juniper.net/JSA10783", "tags": ["Mitigation", "Vendor Advisory"], "source": "sirt@juniper.net"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unprivileged, network-based attacker to cause various system services partial to full denials of services, modification of system states and files, and potential disclosure of sensitive information which may assist the attacker in further attacks on the system through the use of multiple attack vectors, including man-in-the-middle attacks, file injections, and malicious execution of commands causing out of bound memory conditions leading to other attacks."}, {"lang": "es", "value": "Una vulnerabilidad en Juniper Networks NorthStar Controller Application anterior a la versi\u00f3n 2.1.0 Service Pack 1 puede permitir a un atacante no autenticado, sin privilegios y basado en la red, provocar varias denegaciones de servicio parciales o totales de los servicios del sistema, modificaci\u00f3n de estados y archivos del sistema y divulgaci\u00f3n potencial de informaci\u00f3n sensible que puede ayudar al atacante en ataques adicionales al sistema mediante el uso de m\u00faltiples vectores de ataque, incluyendo ataques man-in-the-middle, inyecciones de archivos y ejecuci\u00f3n maliciosa de comandos que provocan condiciones de memoria fuera de l\u00edmites conduciendo a otros ataques."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:juniper:northstar_controller:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBCC1859-771C-44AC-A4C1-AAA6A5E6C1BF", "versionEndIncluding": "2.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "sirt@juniper.net"}