A vulnerability in the web-based management interface of Cisco Video Surveillance Media Server could allow an unauthenticated remote attacker to cause a denial of service (DoS) of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected service. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to cause the web-based management interface to become unreachable resulting in a DoS condition.


A vulnerability in the Bulk Administration Tool (BAT) for Cisco Unity Connection could allow an authenticated remote attacker to cause high disk utilization resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software does not restrict the maximum size of certain files that can be written to disk. An attacker who has valid administrator credentials for an affected system could exploit this vulnerability by sending a crafted remote connection request to an affected system. A successful exploit could allow the attacker to write a file that consumes most of the available disk space on the system causing application functions to operate abnormally and leading to a DoS condition.


A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated remote attacker to cause the CPU utilization to increase to 100 percent causing a denial of service (DoS) condition on an affected device. The vulnerability is due to improper filtering of email messages that contain references to whitelisted URLs. An attacker could exploit this vulnerability by sending a malicious email message that contains a large number of whitelisted URLs. A successful exploit could allow the attacker to cause a sustained DoS condition that could force the affected device to stop scanning and forwarding email messages.


A vulnerability in the Session Initiation Protocol (SIP) inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to cause an affected device to reload or trigger high CPU resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of SIP traffic. An attacker could exploit this vulnerability by sending SIP requests designed to specifically trigger this issue at a high rate across an affected device. Software updates that address this vulnerability are not yet available.


A vulnerability in the implementation of Traffic Flow Confidentiality (TFC) over IPsec functionality in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to cause an affected device to restart unexpectedly resulting in a denial of service (DoS) condition. The vulnerability is due to an error that may occur if the affected software renegotiates the encryption key for an IPsec tunnel when certain TFC traffic is in flight. An attacker could exploit this vulnerability by sending a malicious stream of TFC traffic through an established IPsec tunnel on an affected device. A successful exploit could allow the attacker to cause a daemon process on the affected device to crash which could cause the device to crash and result in a DoS condition.


A vulnerability in the cryptographic hardware accelerator driver of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to cause an affected device to reload resulting in a temporary denial of service (DoS) condition. The vulnerability exists because the affected devices have a limited amount of Direct Memory Access (DMA) memory and the affected software improperly handles resources in low-memory conditions. An attacker could exploit this vulnerability by sending a sustained high rate of malicious traffic to an affected device to exhaust memory on the device. A successful exploit could allow the attacker to exhaust DMA memory on the affected device which could cause the device to reload and result in a temporary DoS condition.


A vulnerability in the Shell Access Filter feature of Cisco Firepower Management Center (FMC) when used in conjunction with remote authentication could allow an unauthenticated remote attacker to cause high disk utilization resulting in a denial of service (DoS) condition. The vulnerability occurs because the configuration of the Shell Access Filter when used with a specific type of remote authentication can cause a system file to have unbounded writes. An attacker could exploit this vulnerability by sending a steady stream of remote authentication requests to the appliance when the specific configuration is applied. Successful exploitation could allow the attacker to increase the size of a system log file so that it consumes most of the disk space. The lack of available disk space could lead to a DoS condition in which the device functions could operate abnormally making the device unstable.


Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes aka INVDoS. NOTE: this can also affect other cryptocurrencies e.g. if they were forked from Bitcoin Core after 2017-11-15.


A vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow an unauthenticated remote attacker to manipulate the product to send a large number of specially crafted HTTP requests to potentially cause the file system to fill up eventually causing a denial of service (DoS) situation.


Denial of Service through Resource Depletion vulnerability in the agent in non-Windows McAfee Agent (MA) 5.0.0 through 5.0.6 5.5.0 and 5.5.1 allows local users to cause DoS unexpected behavior or potentially unauthorized code execution via knowledge of the internal trust mechanism.


All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation.


Some Huawei smart phones with software of Leland-AL00 8.0.0.114(C636) Leland-AL00A 8.0.0.171(C00) have a denial of service (DoS) vulnerability. An attacker can trick a user to install a malicious application to exploit this vulnerability. Due to insufficient verification of the parameter successful exploitation can cause the smartphone black screen until restarting the phone.


All versions of Node.js 8.x 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.


The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression `splitPathRe` used within the `'path'` module for the various path parsing functions including `path.dirname()` `path.extname()` and `path.parse()` was structured in such a way as to allow an attacker to craft a string that when passed through one of these functions could take a significant amount of time to evaluate potentially leading to a full denial of service.


index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service (ReDoS) issue via a crafted multipart/form-data boundary string.


In Ceph before 12.2.3 and 13.x through 13.0.1 the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly allowing for denial of service.


Some Huawei mobile phone with the versions before BLA-L29 8.0.0.145(C432) have a denial of service (DoS) vulnerability because they do not adapt to specific screen gestures. An attacker may trick users into installing a malicious app. As a result apps running on the frontend crash after the users make specific screen gestures.


The AjaxControl component of Oracle WebCenter Interaction Portal 10.3.3 does not validate the names of pages when processing page rename requests. Pages can be renamed to include characters unsupported for URIs by the web server hosting the WCI Portal software (such as IIS). Renaming pages to include unsupported characters such as 0x7f prevents these pages from being accessed over the web server causing a Denial of Service (DoS) to the page. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.


A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can lead to resource exhaustion culminating in a denial of service.


An issue was discovered in gpac 0.8.0. An invalid memory dereference exists in the function FixTrackID located in isom_intern.c which allows attackers to cause a denial of service (DoS) via a crafted input.


A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessionRequest messages.


gmate v0.12+bionic contains a regular expression denial of service (ReDoS) vulnerability in the gedit3 plugin.


XnView MP v0.96.4 was discovered to contain a heap overflow which allows attackers to cause a denial of service (DoS) via a crafted pict file. Related to a User Mode Write AV starting at ntdll!RtlpLowFragHeapFree.


Irfanview

allows

attackers

to

to

cause

a

denial

of

service

(DoS)

via

a

crafted

JPEG

file.

Related

to

\Integer

Divide

By

Zero

starting

at

JPEG2000!ShowPlugInSaveOptions_W+0x00000000000082ea\


A Divide by Zero vulnerability in the function static int read_samples of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file.


Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py.


FFmpeg N-98388-g76a3ee996b allows attackers to cause a denial of service (DoS) via a crafted audio file due to insufficient verification of data authenticity.


XnView MP v0.96.4 was discovered to contain a heap overflow which allows attackers to cause a denial of service (DoS) via a crafted ico file. Related to a Read Access Violation starting at USER32!SmartStretchDIBits+0x33.


** DISPUTED ** A segmentation fault in the redis-server component of Redis 5.0.7 leads to a denial of service (DOS). NOTE: the vendor cannot reproduce this issue in a released version such as 5.0.7.


Ruijie RG-UAC commit 9071227 was discovered to contain a vulnerability in the component /current_action.php?action=reboot which allows attackers to cause a denial of service (DoS) via unspecified vectors.


An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.


A heap-use-after-free in the mpeg_mux_write_packet function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of service (DOS) via a crafted avi file.


Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.


The NetApp HCI H610C H615C and H610S Baseboard Management Controllers (BMC) are shipped with a documented default account and password that should be changed during the initial node setup. During upgrades to Element 11.8 and 12.0 or the Compute Firmware Bundle 12.2.92 the BMC account password on the H610C H615C and H610S platforms is reset to the default documented value which could allow remote attackers to cause a Denial of Service (DoS).


Python 2.7 through 2.7.17 3.5 through 3.5.9 3.6 through 3.6.10 3.7 through 3.7.6 and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.


SANtricity OS Controller Software versions 11.30 and higher are susceptible to a vulnerability which allows an unauthenticated attacker with access to the system to cause a Denial of Service (DoS).


StorageGRID (formerly StorageGRID Webscale) versions 10.0.0 through 11.3 prior to 11.2.0.8 and 11.3.0.4 are susceptible to a vulnerability which allows an unauthenticated remote attacker to cause a Denial of Service (DoS).


Active IQ Unified Manager for VMware vSphere and Windows versions prior to 9.5 are susceptible to a vulnerability which allows administrative users to cause Denial of Service (DoS).


An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to cause persistent denial of service (DOS) via a crafted packet.


A segmentation violation in the Iec104_Deal_FirmUpdate function of IEC104 v1.0 allows attackers to cause a denial of service (DOS).


A segmentation violation in the Iec104_Deal_I function of IEC104 v1.0 allows attackers to cause a denial of service (DOS).


An invalid memory access in the decode function in iptc.cpp of Exiv2 0.27.99.0 allows attackers to cause a denial of service (DOS) via a crafted tif file.


A stack exhaustion issue in the printIFDStructure function of Exiv2 0.27 allows remote attackers to cause a denial of service (DOS) via a crafted file.


A NULL-pointer deference issue was discovered in GNU_gama::set() in ellipsoid.h in Gama 2.04 which can lead to a denial of service (DOS) via segment faults caused by crafted inputs.


tinyexr commit 0.9.5 was discovered to contain an array index error in the tinyexr::SaveEXR component which can lead to a denial of service (DOS).


A float point exception in the printLong function in tags_int.cpp of Exiv2 0.27.99.0 allows attackers to cause a denial of service (DOS) via a crafted tif file.


An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of service (DOS) via a crafted input.


An input validation issue existed in Bluetooth. This issue was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6 tvOS 13.4.8. An attacker in a privileged network position may be able to perform denial of service attack using malformed Bluetooth packets.


In Epson iProjection v2.30 the driver file (EMP_NSAU.sys) allows local users to cause a denial of service (BSOD) via crafted input to the virtual audio device driver with IOCTL 0x9C402402 0x9C402406 or 0x9C40240A. \\Device\\EMPNSAUIO and \\DosDevices\\EMPNSAU are similarly affected.


HUAWEI Mate 20 smart phones with Versions earlier than 10.1.0.163(C00E160R3P8) have a denial of service (DoS) vulnerability. The attacker can enter a large amount of text on the phone. Due to insufficient verification of the parameter successful exploitation can impact the service.


There is a denial of service vulnerability in some Huawei smartphones. Due to the improper processing of received abnormal messages remote attackers may exploit this vulnerability to cause a denial of service (DoS) on the specific module.


A heap buffer-overflow in the client_example1.c component of libiec_iccp_mod v1.5 leads to a denial of service (DOS).


The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains an XML Entity Expansion injection vulnerability which allows an authenticated remote users to trigger a denial of service (DoS) condition. Specifically the vulnerability lies in the 'dashboardXml' parameter. Remediated in >= 7.1.0.25 >= 8.2.0.6 >= 8.3.0.0 GA


An issue was discovered in Xen through 4.14.x. There is mishandling of the constraint that once-valid event channels may not turn invalid. Logic in the handling of event channel operations in Xen assumes that an event channel once valid will not become invalid over the life time of a guest. However operations like the resetting of all event channels may involve decreasing one of the bounds checked when determining validity. This may lead to bug checks triggering crashing the host. An unprivileged guest may be able to crash Xen leading to a Denial of Service (DoS) for the entire system. All Xen versions from 4.4 onwards are vulnerable. Xen versions 4.3 and earlier are not vulnerable. Only systems with untrusted guests permitted to create more than the default number of event channels are vulnerable. This number depends on the architecture and type of guest. For 32-bit x86 PV guests this is 1023; for 64-bit x86 PV guests and for all ARM guests this number is 4095. Systems where untrusted guests are limited to fewer than this number are not vulnerable. Note that xl and libxl limit max_event_channels to 1023 by default so systems using exclusively xl libvirt+libxl or their own toolstack based on libxl and not explicitly setting max_event_channels are not vulnerable.


An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g. smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Systems running all versions of Xen are affected. Whether a system is vulnerable will depend on the CPU and compiler used to build Xen. For all systems the presence and the scope of the vulnerability depend on the precise re-ordering performed by the compiler used to build Xen. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code generation options). GCC documentation clearly suggests that re-ordering is possible. Arm systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU vendor. x86 systems are only vulnerable if a compiler performs re-ordering.


An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read Copy Update) mechanism is a synchronisation primitive. A buggy error path in the XENMEM_acquire_resource exits without releasing an RCU reference which is conceptually similar to forgetting to unlock a spinlock. A buggy or malicious HVM stubdomain can cause an RCU reference to be leaked. This causes subsequent administration operations (e.g. CPU offline) to livelock resulting in a host Denial of Service. The buggy codepath has been present since Xen 4.12. Xen 4.14 and later are vulnerable to the DoS. The side effects are believed to be benign on Xen 4.12 and 4.13 but patches are provided nevertheless. The vulnerability can generally only be exploited by x86 HVM VMs as these are generally the only type of VM that have a Qemu stubdomain. x86 PV and PVH domains as well as ARM VMs typically don't use a stubdomain. Only VMs using HVM stubdomains can exploit the vulnerability. VMs using PV stubdomains or with emulators running in dom0 cannot exploit the vulnerability.


An issue was discovered in Xen through 4.14.x. There is a lack of preemption in evtchn_reset() / evtchn_destroy(). In particular the FIFO event channel model allows guests to have a large number of event channels active at a time. Closing all of these (when resetting all event channels or when cleaning up after the guest) may take extended periods of time. So far there was no arrangement for preemption at suitable intervals allowing a CPU to spend an almost unbounded amount of time in the processing of these operations. Malicious or buggy guest kernels can mount a Denial of Service (DoS) attack affecting the entire system. All Xen versions are vulnerable in principle. Whether versions 4.3 and older are vulnerable depends on underlying hardware characteristics.


SaferVPN before 5.0.3.3 on Windows could allow low-privileged users to create or overwrite arbitrary files which could cause a denial of service (DoS) condition because a symlink from %LOCALAPPDATA%\\SaferVPN\\Log is followed.


An issue was discovered in Xen through 4.14.x. The PCI passthrough code improperly uses register data. Code paths in Xen's MSI handling have been identified that act on unsanitized values read back from device hardware registers. While devices strictly compliant with PCI specifications shouldn't be able to affect these registers experience shows that it's very common for devices to have out-of-spec \backdoor\ operations that can affect the result of these reads. A not fully trusted guest may be able to crash Xen leading to a Denial of Service (DoS) for the entire system. Privilege escalation and information leaks cannot be excluded. All versions of Xen supporting PCI passthrough are affected. Only x86 systems are vulnerable. Arm systems are not vulnerable. Only guests with passed through PCI devices may be able to leverage the vulnerability. Only systems passing through devices with out-of-spec (\backdoor\) functionality can cause issues. Experience shows that such out-of-spec functionality is common; unless you have reason to believe that your device does not have such functionality it's better to assume that it does.


An issue was discovered in NFStream 5.2.0. Because some allocated modules are not correctly freed if the nfstream object is directly destroyed without being used after it is created it will cause a memory leak that may result in a local denial of service (DoS).


An issue was discovered in Xen through 4.14.x. Out of bounds event channels are available to 32-bit x86 domains. The so called 2-level event channel model imposes different limits on the number of usable event channels for 32-bit x86 domains vs 64-bit or Arm (either bitness) ones. 32-bit x86 domains can use only 1023 channels due to limited space in their shared (between guest and Xen) information structure whereas all other domains can use up to 4095 in this model. The recording of the respective limit during domain initialization however has occurred at a time where domains are still deemed to be 64-bit ones prior to actually honoring respective domain properties. At the point domains get recognized as 32-bit ones the limit didn't get updated accordingly. Due to this misbehavior in Xen 32-bit domains (including Domain 0) servicing other domains may observe event channel allocations to succeed when they should really fail. Subsequent use of such event channels would then possibly lead to corruption of other parts of the shared info structure. An unprivileged guest may cause another domain in particular Domain 0 to misbehave. This may lead to a Denial of Service (DoS) for the entire system. All Xen versions from 4.4 onwards are vulnerable. Xen versions 4.3 and earlier are not vulnerable. Only x86 32-bit domains servicing other domains are vulnerable. Arm systems as well as x86 64-bit domains are not vulnerable.


A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat.


An issue was discovered in the stripTags and unescapeHTML components in Prototype 1.7.3 where an attacker can cause a Regular Expression Denial of Service (ReDOS) through stripping crafted HTML tags.


A vulnerability in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) Software could allow an authenticated remote attacker to cause the Cisco XCP Authentication Service on an affected device to restart resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of login requests. An attacker could exploit this vulnerability by sending a crafted client login request to an affected device. A successful exploit could allow the attacker to cause a process to crash resulting in a DoS condition for new login attempts. Users who are authenticated at the time of the attack would not be affected. There are workarounds that address this vulnerability.


The parseXML function in Easy-XML 0.5.0 was discovered to have a XML External Entity (XXE) vulnerability which allows for an attacker to expose sensitive data or perform a denial of service (DOS) via a crafted external entity entered into the XML content as input.


A vulnerability in the ingress packet processing function of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper resource allocation when an affected device processes network traffic in software switching mode (punted). An attacker could exploit this vulnerability by sending specific streams of Layer 2 or Layer 3 protocol data units (PDUs) to an affected device. A successful exploit could cause the affected device to run out of buffer resources which could make the device unable to process or forward traffic resulting in a DoS condition. The device would need to be restarted to regain functionality.


Fast-csv is an npm package for parsing and formatting CSVs or any other delimited value file in node. In fast-cvs before version 4.3.6 there is a possible ReDoS vulnerability (Regular Expression Denial of Service) when using ignoreEmpty option when parsing. This has been patched in `v4.3.6` You will only be affected by this if you use the `ignoreEmpty` parsing option. If you do use this option it is recommended that you upgrade to the latest version `v4.3.6` This vulnerability was found using a CodeQL query which identified `EMPTY_ROW_REGEXP` regular expression as vulnerable.


Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user can lead to the Kibana process consuming large amounts of CPU and becoming unresponsive.


The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).


websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.


The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.


websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.


All

versions

of

package

djvalidator

are

vulnerable

to

Regular

Expression

Denial

of

Service

(ReDoS)

by

sending

crafted

invalid

emails

for

example


Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based Denial of Service (DoS) vulnerability in JQL version searching. The affected versions are before version 7.13.16; from version 7.14.0 before 8.5.7; from version 8.6.0 before 8.10.2; and from version 8.11.0 before 8.11.1.


The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4 from 8.5.0 before 8.5.5 from 8.8.0 before 8.8.2 and from 8.9.0 before 8.9.1 allows remote attackers to impact the application's availability via an Denial of Service (DoS) vulnerability.


Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the MessageBundleResource within Atlassian Gadgets. The affected versions are before version 4.8.4.


A flaw was found in the default configuration of dnsmasq as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.


Vulnerability

in

the

Hyperion

Analytic

Provider

Services

product

of

Oracle

Hyperion

(component:

Smart

View

Provider).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

with

access

to

the

physical

communication

segment

attached

to

the

hardware

where

the

Hyperion

Analytic

Provider

Services

executes

to

compromise

Hyperion

Analytic

Provider

Services.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Hyperion

Analytic

Provider

Services

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Hyperion

Analytic

Provider

Services

accessible

data

and

unauthorized

ability

to

cause

a

partial

denial

of

service

(partial

DOS)

of

Hyperion

Analytic

Provider

Services.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L).


HCL Domino is susceptible to a Denial of Service (DoS) vulnerability due to insufficient validation of input to its public API. An unauthenticated attacker could could exploit this vulnerability to crash the Domino server.


A vulnerability in SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service by sending a malicious HTTP request that leads to memory addresses leak. This vulnerability affected SonicOS Gen 5 version 5.9.1.7 5.9.1.13 Gen 6 version 6.5.4.7 6.5.1.12 6.0.5.3 SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0.


uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This has been patched in uap-core 0.7.3.


Uncontrolled resource consumption vulnerability in Ethernet Port on MELSEC iQ-R Q and L series CPU modules (R 00/01/02 CPU firmware versions '20' and earlier R 04/08/16/32/120 (EN) CPU firmware versions '52' and earlier R 08/16/32/120 SFCPU firmware versions '22' and earlier R 08/16/32/120 PCPU all versions R 08/16/32/120 PSFCPU all versions R 16/32/64 MTCPU all versions Q03 UDECPU Q 04/06/10/13/20/26/50/100 UDEHCPU serial number '22081' and earlier Q 03/04/06/13/26 UDVCPU serial number '22031' and earlier Q 04/06/13/26 UDPVCPU serial number '22031' and earlier Q 172/173 DCPU all versions Q 172/173 DSCPU all versions Q 170 MCPU all versions Q 170 MSCPU all versions L 02/06/26 CPU (-P) and L 26 CPU - (P) BT all versions) allows a remote unauthenticated attacker to stop the Ethernet communication functions of the products via a specially crafted packet which may lead to a denial of service (DoS) condition .


On BIG-IP 14.1.0-14.1.2.3 undisclosed requests can lead to a denial of service (DoS) when sent to BIG-IP HTTP/2 virtual servers. The problem can occur when ciphers which have been blacklisted by the HTTP/2 RFC are used on backend servers. This is a data-plane issue. There is no control-plane exposure.


A vulnerability in SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS) due to the release of Invalid pointer and leads to a firewall crash. This vulnerability affected SonicOS Gen 5 version 5.9.1.7 5.9.1.13 Gen 6 version 6.5.4.7 6.5.1.12 6.0.5.3 SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0.


Uncontrolled resource consumption vulnerability in Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver. 1.94Y and earlier CW Configurator Ver. 1.010L and earlier EM Software Development Kit (EM Configurator) Ver. 1.010L and earlier GT Designer3 (GOT2000) Ver. 1.221F and earlier GX LogViewer Ver. 1.96A and earlier GX Works2 Ver. 1.586L and earlier GX Works3 Ver. 1.058L and earlier M_CommDTM-HART Ver. 1.00A M_CommDTM-IO-Link Ver. 1.02C and earlier MELFA-Works Ver. 4.3 and earlier MELSEC-L Flexible High-Speed I/O Control Module Configuration Tool Ver.1.004E and earlier MELSOFT FieldDeviceConfigurator Ver. 1.03D and earlier MELSOFT iQ AppPortal Ver. 1.11M and earlier MELSOFT Navigator Ver. 2.58L and earlier MI Configurator Ver. 1.003D and earlier Motion Control Setting Ver. 1.005F and earlier MR Configurator2 Ver. 1.72A and earlier MT Works2 Ver. 1.156N and earlier RT ToolBox2 Ver. 3.72A and earlier and RT ToolBox3 Ver. 1.50C and earlier) allows an attacker to cause a denial of service (DoS) condition attacks via unspecified vectors.


A Heap Overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS) on the firewall SSLVPN service and leads to SonicOS crash. This vulnerability affected SonicOS Gen 5 version 5.9.1.7 5.9.1.13 Gen 6 version 6.5.4.7 6.5.1.12 6.0.5.3 SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0.


Missing access control restrictions in the Hypervisor component of the ACRN Project (v2.0 and v1.6.1) allow a malicious entity with root access in the Service VM userspace to abuse the PCIe assign/de-assign Hypercalls via crafted ioctls and payloads. This attack results in a corrupt state and Denial of Service (DoS) for previously assigned PCIe devices to the Service VM at runtime.


An issue was discovered in Xen through 4.13.x allowing Arm guest OS users to cause a hypervisor crash because of a missing alignment check in VCPUOP_register_vcpu_info. The hypercall VCPUOP_register_vcpu_info is used by a guest to register a shared region with the hypervisor. The region will be mapped into Xen address space so it can be directly accessed. On Arm the region is accessed with instructions that require a specific alignment. Unfortunately there is no check that the address provided by the guest will be correctly aligned. As a result a malicious guest could cause a hypervisor crash by passing a misaligned address. A malicious guest administrator may cause a hypervisor crash resulting in a Denial of Service (DoS). All Xen versions are vulnerable. Only Arm systems are vulnerable. x86 systems are not affected.


An issue was discovered in Xen through 4.13.x allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 HVM guests' dirty video RAM tracking code allows such guests to make Xen de-reference a pointer guaranteed to point at unmapped space. A malicious or buggy HVM guest may cause the hypervisor to crash resulting in Denial of Service (DoS) affecting the entire host. Xen versions from 4.8 onwards are affected. Xen versions 4.7 and earlier are not affected. Only x86 systems are affected. Arm systems are not affected. Only x86 HVM guests using shadow paging can leverage the vulnerability. In addition there needs to be an entity actively monitoring a guest's video frame buffer (typically for display purposes) in order for such a guest to be able to leverage the vulnerability. x86 PV guests as well as x86 HVM guests using hardware assisted paging (HAP) cannot leverage the vulnerability.


An issue was discovered in Xen through 4.13.x allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm this means a processor is allowed to re-order the memory access with the preceding ones. In other words the unlock may be seen by another processor before all the memory accesses within the \critical\ section. As a consequence it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words many of the assumptions (e.g. a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones) so a malicious guest could exploit the race. For instance there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded.


In whoopsie parse_report() from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The DoS is caused by resource exhaustion due to a memory leak. Fixed in 0.2.52.5ubuntu0.5 0.2.62ubuntu0.5 and 0.2.69ubuntu0.1.


An issue was discovered in xenoprof in Xen through 4.13.x allowing guest OS users (with active profiling) to obtain sensitive information about other guests cause a denial of service or possibly gain privileges. For guests for which \active\ profiling was enabled by the administrator the xenoprof code uses the standard Xen shared ring structure. Unfortunately this code did not treat the guest as a potential adversary: it trusts the guest not to modify buffer size information or modify head / tail pointers in unexpected ways. This can crash the host (DoS). Privilege escalation cannot be ruled out.


An issue was discovered in Xen through 4.14.x. Xenstored and guests communicate via a shared memory page using a specific protocol. When a guest violates this protocol xenstored will drop the connection to that guest. Unfortunately this is done by just removing the guest from xenstored's internal management resulting in the same actions as if the guest had been destroyed including sending an @releaseDomain event. @releaseDomain events do not say that the guest has been removed. All watchers of this event must look at the states of all guests to find the guest that has been removed. When an @releaseDomain is generated due to a domain xenstored protocol violation because the guest is still running the watchers will not react. Later when the guest is actually destroyed xenstored will no longer have it stored in its internal data base so no further @releaseDomain event will be sent. This can lead to a zombie domain; memory mappings of that guest's memory will not be removed due to the missing event. This zombie domain will be cleaned up only after another domain is destroyed as that will trigger another @releaseDomain event. If the device model of the guest that violated the Xenstore protocol is running in a stub-domain a use-after-free case could happen in xenstored after having removed the guest from its internal data base possibly resulting in a crash of xenstored. A malicious guest can block resources of the host for a period after its own death. Guests with a stub domain device model can eventually crash xenstored resulting in a more serious denial of service (the prevention of any further domain management operations). Only the C variant of Xenstore is affected; the Ocaml variant is not affected. Only HVM guests with a stubdom device model can cause a serious DoS.


An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and that of pointers into the control block is reversed. The consumer assumes seeing the former initialized that the latter are also ready for use. Malicious or buggy guest kernels can mount a Denial of Service (DoS) attack affecting the entire system.


Affected versions of Atlassian Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the file upload request feature of code reviews. The affected versions are before version 4.7.4 and from version 4.8.0 before 4.8.5.


An issue was discovered in Xen through 4.14.x. A bounds check common to most operation time functions specific to FIFO event channels depends on the CPU observing consistent state. While the producer side uses appropriately ordered writes the consumer side isn't protected against re-ordered reads and may hence end up de-referencing a NULL pointer. Malicious or buggy guest kernels can mount a Denial of Service (DoS) attack affecting the entire system. Only Arm systems may be vulnerable. Whether a system is vulnerable depends on the specific CPU. x86 systems are not vulnerable.


An issue was discovered in Xen 4.14.x. When moving IRQs between CPUs to distribute the load of IRQ handling IRQ vectors are dynamically allocated and de-allocated on the relevant CPUs. De-allocation has to happen when certain constraints are met. If these conditions are not met when first checked the checking CPU may send an interrupt to itself in the expectation that this IRQ will be delivered only after the condition preventing the cleanup has cleared. For two specific IRQ vectors this expectation was violated resulting in a continuous stream of self-interrupts which renders the CPU effectively unusable. A domain with a passed through PCI device can cause lockup of a physical CPU resulting in a Denial of Service (DoS) to the entire host. Only x86 systems are vulnerable. Arm systems are not vulnerable. Only guests with physical PCI devices passed through to them can exploit the vulnerability.


An issue was discovered in Xen through 4.14.x. When they require assistance from the device model x86 HVM guests must be temporarily de-scheduled. The device model will signal Xen when it has completed its operation via an event channel so that the relevant vCPU is rescheduled. If the device model were to signal Xen without having actually completed the operation the de-schedule / re-schedule cycle would repeat. If in addition Xen is resignalled very quickly the re-schedule may occur before the de-schedule was fully complete triggering a shortcut. This potentially repeating process uses ordinary recursive function calls and thus could result in a stack overflow. A malicious or buggy stubdomain serving a HVM guest can cause Xen to crash resulting in a Denial of Service (DoS) to the entire host. Only x86 systems are affected. Arm systems are not affected. Only x86 stubdomains serving HVM guests can exploit the vulnerability.


The package jointjs before 3.3.0 are vulnerable to Denial of Service (DoS) via the unsetByPath function.


The

kernel

memory

usage

represented

as

\temp\

via

'show

system

virtual-memory'

may

constantly

increase

when

Integrated

Routing

and

Bridging

(IRB)

is

configured

with

multiple

underlay

physical

interfaces

and

one

interface

flaps.

This

memory

leak

can

affect

running

daemons

(processes)

leading

to

an

extended

Denial

of

Service

(DoS)

condition.

Usage

of

\temp\

virtual

memory

shown

here

by

a

constantly

increasing

value

of

outstanding

Requests

can

be

monitored

by

executing

the

'show

system

virtual-memory'

command

as

shown

below:

user@junos>

show

system

virtual-memory

|match

\fpc|type|temp\

Type

InUse

MemUse

HighUse

Requests

Size(s)

temp

Type

InUse

MemUse

HighUse

Requests

Size(s)

temp

user@junos>

show

system

virtual-memory

|match

\fpc|type|temp\

Type

InUse

MemUse

HighUse

Requests

Size(s)

temp

Type

InUse

MemUse

HighUse

Requests

Size(s)

temp

user@junos>

show

system

virtual-memory

|match

\fpc|type|temp\

Type

InUse

MemUse

HighUse

Requests

Size(s)

temp

Type

InUse

MemUse

HighUse

Requests

Size(s)

temp

This

issue

affects

Juniper

Networks

Junos

OS:

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

This

issue

does

not

affect

Juniper

Networks

Junos

OS

and


Execution of the \show ospf interface extensive\ or \show ospf interface detail\ CLI commands on a Juniper Networks device running Junos OS may cause the routing protocols process (RPD) to crash and restart if OSPF interface authentication is configured leading to a Denial of Service (DoS). By continuously executing the same CLI commands a local attacker can repeatedly crash the RPD process causing a sustained Denial of Service. Note: Only systems utilizing ARM processors found on the EX2300 and EX3400 are vulnerable to this issue. Systems shipped with other processor architectures are not vulnerable to this issue. The processor architecture can be displayed via the 'uname -a' command. For example: ARM (vulnerable): % uname -a | awk '{print $NF}' arm PowerPC (not vulnerable): % uname -a | awk '{print $NF}' powerpc AMD (not vulnerable): % uname -a | awk '{print $NF}' amd64 Intel (not vulnerable): % uname -a | awk '{print $NF}' i386 This issue affects Juniper Networks Junos OS: 12.3X48 versions prior to 12.3X48-D100; 14.1X53 versions prior to 14.1X53-D140 14.1X53-D54; 15.1 versions prior to 15.1R7-S7; 15.1X49 versions prior to 15.1X49-D210; 15.1X53 versions prior to 15.1X53-D593; 16.1 versions prior to 16.1R7-S8; 17.1 versions prior to 17.1R2-S12; 17.2 versions prior to 17.2R3-S4; 17.3 versions prior to 17.3R3-S8; 17.4 versions prior to 17.4R2-S2 17.4R3; 18.1 versions prior to 18.1R3-S2; 18.2 versions prior to 18.2R2 18.2R3; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S2 18.3R2.


When an attacker sends a specific crafted Ethernet Operation Administration and Maintenance (Ethernet OAM) packet to a target device it may improperly handle the incoming malformed data and fail to sanitize this incoming data resulting in an overflow condition. This overflow condition in Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) condition by coring the CFM daemon. Continued receipt of these packets may cause an extended Denial of Service condition. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S15; 12.3X48 versions prior to 12.3X48-D95 on SRX Series; 14.1X50 versions prior to 14.1X50-D145; 14.1X53 versions prior to 14.1X53-D47; 15.1 versions prior to 15.1R2; 15.1X49 versions prior to 15.1X49-D170 on SRX Series; 15.1X53 versions prior to 15.1X53-D67.


On Juniper Networks Junos OS devices configured with DHCPv6 relay enabled receipt of a specific DHCPv6 packet might crash the jdhcpd daemon. The jdhcpd daemon automatically restarts without intervention but continuous receipt of specific crafted DHCP messages will repeatedly crash jdhcpd leading to an extended Denial of Service (DoS) condition. Only DHCPv6 packet can trigger this issue. DHCPv4 packet cannot trigger this issue. This issue affects Juniper Networks Junos OS: 17.3 versions prior to 17.3R3-S9; 17.4 versions prior to 17.4R2-S11 17.4R3-S2 17.4R3-S3; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S5; 18.3 versions prior to 18.3R2-S4 18.3R3-S3; 18.4 versions prior to 18.4R2-S5 18.4R3-S4; 19.1 versions prior to 19.1R2-S2 19.1R3-S2; 19.2 versions prior to 19.2R1-S5 19.2R2-S1 19.2R3; 19.3 versions prior to 19.3R2-S4 19.3R2-S4 19.3R3; 19.4 versions prior to 19.4R1-S3 19.4R2-S1 19.4R3; 20.1 versions prior to 20.1R1-S3 20.1R2.


On SRX Series devices a vulnerability in the key-management-daemon (kmd) daemon of Juniper Networks Junos OS allows an attacker to spoof packets targeted to IPSec peers before a security association (SA) is established thereby causing a failure to set up the IPSec channel. Sustained receipt of these spoofed packets can cause a sustained Denial of Service (DoS) condition. This issue affects IPv4 and IPv6 implementations. This issue affects Juniper Networks Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D90; 15.1X49 versions prior to 15.1X49-D190; 17.4 versions prior to 17.4R2-S9 17.4R3; 18.1 versions prior to 18.1R3-S9; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R1-S7 18.3R2-S3 18.3R3; 18.4 versions prior to 18.4R1-S6 18.4R2-S3 18.4R3; 19.1 versions prior to 19.1R1-S4 19.1R2. This issue does not affect 12.3 or 15.1 releases which are non-SRX Series releases.


Huawei NIP6800 versions V500R001C30 V500R001C60SPC500 and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200 V500R001C30SPC600 V500R001C60SPC500 and V500R005C00 have a Denial of Service (DoS) vulnerability. Due to improper processing of specific IPSEC packets remote attackers can send constructed IPSEC packets to affected devices to exploit this vulnerability. Successful exploit could cause the IPSec function of the affected device abnormal.


In a Point-to-Multipoint (P2MP) Label Switched Path (LSP) scenario an uncontrolled resource consumption vulnerability in the Routing Protocol Daemon (RPD) in Juniper Networks Junos OS allows a specific SNMP request to trigger an infinite loop causing a high CPU usage Denial of Service (DoS) condition. This issue affects both SNMP over IPv4 and IPv6. This issue affects: Juniper Networks Junos OS: 12.3X48 versions prior to 12.3X48-D90; 15.1 versions prior to 15.1R7-S6; 15.1X49 versions prior to 15.1X49-D200; 15.1X53 versions prior to 15.1X53-D238 15.1X53-D592; 16.1 versions prior to 16.1R7-S5; 16.2 versions prior to 16.2R2-S11; 17.1 versions prior to 17.1R3-S1; 17.2 versions prior to 17.2R3-S2; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R2-S4 17.4R3; 18.1 versions prior to 18.1R3-S5; 18.2 versions prior to 18.2R3; 18.2X75 versions prior to 18.2X75-D50; 18.3 versions prior to 18.3R2; 18.4 versions prior to 18.4R2; 19.1 versions prior to 19.1R2.


A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources become unresponsive or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.


Certain types of malformed Path Computation Element Protocol (PCEP) packets when received and processed by a Juniper Networks Junos OS device serving as a Path Computation Client (PCC) in a PCEP environment using Juniper's path computational element protocol daemon (pccd) process allows an attacker to cause the pccd process to crash and generate a core file thereby causing a Denial of Service (DoS). Continued receipt of this family of malformed PCEP packets will cause an extended Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS: 15.1 versions prior to 15.1F6-S13 15.1R7-S4; 15.1X49 versions prior to 15.1X49-D180 on SRX Series; 15.1X53 versions prior to 15.1X53-D238 15.1X53-D496 15.1X53-D592; 16.1 versions prior to 16.1R7-S4; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R2-S11 17.1R3; 17.2 versions prior to 17.2R1-S9; 17.2 version 17.2R2 and later prior to 17.2R3-S2; 17.3 versions prior to 17.3R3-S3; 17.4 versions prior to 17.4R2-S2 17.4R3; 18.1 versions prior to 18.1R3-S2; 18.2 versions prior to 18.2R2-S6 18.2R3; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R2; 18.4 versions prior to 18.4R1-S2 18.4R2. This issue does not affect releases of Junos OS prior to 15.1R1.


On Juniper Networks Junos OS and Junos OS Evolved devices processing a specific UPDATE for an EBGP peer can lead to a routing process daemon (RPD) crash and restart. This issue occurs only when the device is receiving and processing the BGP UPDATE for an EBGP peer. This issue does not occur when the device is receiving and processing the BGP UPDATE for an IBGP peer. However the offending BGP UPDATE can originally come from an EBGP peer propagates through the network via IBGP peers without causing crash then it causes RPD crash when it is processed for a BGP UPDATE towards an EBGP peer. Repeated receipt and processing of the same specific BGP UPDATE can result in an extended Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS: 17.3R3-S6 17.4R2-S7 and 18.1R3-S7. Juniper Networks Junos OS Evolved 19.2R2-EVO and later versions prior to 19.3R1-EVO. Other Junos OS releases are not affected.


The FPC (Flexible PIC Concentrator) of Juniper Networks Junos OS and Junos OS Evolved may restart after processing a specific IPv4 packet. Only packets destined to the device itself successfully reaching the RE through existing edge and control plane filtering will be able to cause the FPC restart. When this issue occurs all traffic via the FPC will be dropped. By continuously sending this specific IPv4 packet an attacker can repeatedly crash the FPC causing an extended Denial of Service (DoS) condition. This issue can only occur when processing a specific IPv4 packet. IPv6 packets cannot trigger this issue. This issue affects: Juniper Networks Junos OS on MX Series with MPC10E or MPC11E and PTX10001: 19.2 versions prior to 19.2R1-S4 19.2R2; 19.3 versions prior to 19.3R2-S2 19.3R3; 19.4 versions prior to 19.4R1-S1 19.4R2. Juniper Networks Junos OS Evolved on on QFX5220 and PTX10003 series: 19.2-EVO versions; 19.3-EVO versions; 19.4-EVO versions prior to 19.4R2-EVO. This issue does not affect Junos OS versions prior to 19.2R1. This issue does not affect Junos OS Evolved versions prior to 19.2R1-EVO.


An input validation vulnerability exists in Juniper Networks Junos OS allowing an attacker to crash the srxpfe process causing a Denial of Service (DoS) through the use of specific maintenance commands. The srxpfe process restarts automatically but continuous execution of the commands could lead to an extended Denial of Service condition. This issue only affects the SRX1500 SRX4100 SRX4200 NFX150 NFX250 and vSRX-based platforms. No other products or platforms are affected by this vulnerability. This issue affects Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D220 on SRX1500 SRX4100 SRX4200 vSRX; 17.4 versions prior to 17.4R3-S3 on SRX1500 SRX4100 SRX4200 vSRX; 18.1 versions prior to 18.1R3-S11 on SRX1500 SRX4100 SRX4200 vSRX NFX150; 18.2 versions prior to 18.2R3-S5 on SRX1500 SRX4100 SRX4200 vSRX NFX150 NFX250; 18.3 versions prior to 18.3R2-S4 18.3R3-S3 on SRX1500 SRX4100 SRX4200 vSRX NFX150 NFX250; 18.4 versions prior to 18.4R2-S5 18.4R3-S4 on SRX1500 SRX4100 SRX4200 vSRX NFX150 NFX250; 19.1 versions prior to 19.1R3-S2 on SRX1500 SRX4100 SRX4200 vSRX NFX150 NFX250; 19.2 versions prior to 19.2R1-S5 19.2R3 on SRX1500 SRX4100 SRX4200 vSRX NFX150 NFX250. This issue does not affect Junos OS 19.3 or any subsequent version.


On Juniper Networks MX Series and EX9200 Series in a certain condition the IPv6 Distributed Denial of Service (DDoS) protection might not take affect when it reaches the threshold condition. The DDoS protection allows the device to continue to function while it is under DDoS attack protecting both the Routing Engine (RE) and the Flexible PIC Concentrator (FPC) during the DDoS attack. When this issue occurs the RE and/or the FPC can become overwhelmed which could disrupt network protocol operations and/or interrupt traffic. This issue does not affect IPv4 DDoS protection. This issue affects MX Series and EX9200 Series with Trio-based PFEs (Packet Forwarding Engines). Please refer to https://kb.juniper.net/KB25385 for the list of Trio-based PFEs. This issue affects Juniper Networks Junos OS on MX series and EX9200 Series: 17.2 versions prior to 17.2R3-S4; 17.2X75 versions prior to 17.2X75-D102 17.2X75-D110; 17.3 versions prior to 17.3R3-S8; 17.4 versions prior to 17.4R2-S11 17.4R3-S2; 18.2 versions prior to 18.2R2-S7 18.2R3 18.2R3-S3; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R2-S4 18.3R3-S2.


On Juniper Networks Junos OS devices configured as a DHCP forwarder the Juniper Networks Dynamic Host Configuration Protocol Daemon (jdhcp) process might crash when receiving a malformed DHCP packet. This issue only affects devices configured as DHCP forwarder with forward-only option that forward specified DHCP client packets without creating a new subscriber session. The jdhcpd daemon automatically restarts without intervention but continuous receipt of the malformed DHCP packet will repeatedly crash jdhcpd leading to an extended Denial of Service (DoS) condition. This issue can be triggered only by DHCPv4 it cannot be triggered by DHCPv6. This issue affects Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S16; 12.3X48 versions prior to 12.3X48-D105 on SRX Series; 14.1X53 versions prior to 14.1X53-D60 on EX and QFX Series; 15.1 versions prior to 15.1R7-S7; 15.1X49 versions prior to 15.1X49-D221 15.1X49-D230 on SRX Series; 15.1X53 versions prior to 15.1X53-D593 on EX2300/EX3400; 16.1 versions prior to 16.1R7-S5.


On Juniper Networks Junos OS and Junos OS Evolved devices processing a specific BGP packet can lead to a routing process daemon (RPD) crash and restart. This issue can occur even before the BGP session with the peer is established. Repeated receipt of this specific BGP packet can result in an extended Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS: 18.2X75 versions starting from 18.2X75-D50.8 18.2X75-D60 and later versions prior to 18.2X75-D52.8 18.2X75-D53 18.2X75-D60.2 18.2X75-D65.1 18.2X75-D70; 19.4 versions 19.4R1 and 19.4R1-S1; 20.1 versions prior to 20.1R1-S2 20.1R2. Juniper Networks Junos OS Evolved: 19.4-EVO versions prior to 19.4R2-S2-EVO; 20.1-EVO versions prior to 20.1R2-EVO. This issue does not affect: Juniper Networks Junos OS releases prior to 19.4R1. Juniper Networks Junos OS Evolved releases prior to 19.4R1-EVO.


Specific IPv6 packets sent by clients processed by the Routing Engine (RE) are improperly handled. These IPv6 packets are designed to be blocked by the RE from egressing the RE. Instead the RE allows these specific IPv6 packets to egress the RE at which point a mbuf memory leak occurs within the Juniper Networks Junos OS device. This memory leak eventually leads to a kernel crash (vmcore) or the device hanging and requiring a power cycle to restore service creating a Denial of Service (DoS) condition. During the time where mbufs are rising yet not fully filled some traffic from client devices may begin to be black holed. To be black holed this traffic must match the condition where this traffic must be processed by the RE. Continued receipt and attempted egress of these specific IPv6 packets from the Routing Engine (RE) will create an extended Denial of Service (DoS) condition. Scenarios which have been observed are: 1. In a single chassis single RE scenario the device will hang without vmcore or a vmcore may occur and then hang. In this scenario the device needs to be power cycled. 2. In a single chassis dual RE scenario the device master RE will fail over to the backup RE. In this scenario the master and the backup REs need to be reset from time to time when they vmcore. There is no need to power cycle the device. 3. In a dual chassis single RE scenario the device will hang without vmcore or a vmcore may occur and then hang. In this scenario the two chassis' design relies upon some type of network level redundancy - VRRP GRES NSR etc. - 3.a In a commanded switchover where nonstop active routing (NSR) is enabled no session loss is observed. 4. In a dual chassis dual chassis scenario rely upon the RE to RE failover as stated in the second scenario. In the unlikely event that the device does not switch RE to RE gracefully then the fallback position is to the network level services scenario in the third scenario. This issue affects: Juniper Networks Junos OS 16.1 versions prior to 16.1R7-S6; 16.1 version 16.1X70-D10 and later; 16.2 versions prior to 16.2R2-S11; 17.1 versions prior to 17.1R2-S11 17.1R3-S1; 17.2 versions prior to 17.2R1-S9 17.2R2-S8 17.2R3-S3; 17.3 versions prior to 17.3R3-S6; 17.4 versions prior to 17.4R2-S9 17.4R3; 18.1 versions prior to 18.1R3-S7; 18.2 versions prior to 18.2R3-S2; 18.2X75 versions prior to 18.2X75-D50 18.2X75-D410; 18.3 versions prior to 18.3R1-S6 18.3R2-S2 18.3R3; 18.4 versions prior to 18.4R1-S6 18.4R2-S2 18.4R3; 19.1 versions prior to 19.1R1-S3 19.1R2; 19.2 versions prior to 19.2R1-S2 19.2R2. This issue does not affect releases prior to Junos OS 16.1R1.


In a certain condition receipt of a specific BGP UPDATE message might cause Juniper Networks Junos OS and Junos OS Evolved devices to advertise an invalid BGP UPDATE message to other peers causing the other peers to terminate the established BGP session creating a Denial of Service (DoS) condition. For example Router A sends a specific BGP UPDATE to Router B causing Router B to send an invalid BGP UPDATE message to Router C resulting in termination of the BGP session between Router B and Router C. This issue might occur when there is at least a single BGP session established on the device that does not support 4 Byte AS extension (RFC 4893). Repeated receipt of the same BGP UPDATE can result in an extended DoS condition. This issue affects Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S6; 16.2 versions prior to 16.2R2-S11; 17.1 versions prior to 17.1R2-S11 17.1R3-S2; 17.2 versions prior to 17.2R1-S9 17.2R2-S8 17.2R3-S3; 17.2X75 versions prior to 17.2X75-D105 17.2X75-D110 17.2X75-D44; 17.3 versions prior to 17.3R2-S5 17.3R3-S7; 17.4 versions prior to 17.4R2-S8 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R2-S6 18.2R3-S2; 18.2X75 versions prior to 18.2X75-D12 18.2X75-D33 18.2X75-D411 18.2X75-D420 18.2X75-D51 18.2X75-D60; 18.3 versions prior to 18.3R1-S6 18.3R2-S3 18.3R3; 18.4 versions prior to 18.4R1-S5 18.4R3; 18.4 version 18.4R2 and later versions; 19.1 versions prior to 19.1R1-S3 19.1R2; 19.2 versions prior to 19.2R1-S2 19.2R2. This issue does not affect Juniper Networks Junos OS prior to 16.1R1. This issue affects Juniper Networks Junos OS Evolved prior to 19.2R2-EVO.


A vulnerability in Juniper Networks Junos OS Evolved may allow an attacker to cause a Denial of Service (DoS) by sending a high rate of specific packets to the device resulting in a pfemand process crash. The pfemand process is responsible for packet forwarding on the device. By continuously sending the packet flood an attacker can repeatedly crash the pfemand process causing a sustained Denial of Service. This issue can only be triggered by traffic sent to the device. Transit traffic does not cause this issue. This issue affects all version of Junos OS Evolved prior to 19.1R1-EVO.


This issue occurs on Juniper Networks Junos OS devices which do not support Advanced Forwarding Interface (AFI) / Advanced Forwarding Toolkit (AFT). Devices using AFI and AFT are not exploitable to this issue. An improper initialization of memory in the packet forwarding architecture in Juniper Networks Junos OS non-AFI/AFT platforms which may lead to a Denial of Service (DoS) vulnerability being exploited when a genuine packet is received and inspected by non-AFT/AFI sFlow and when the device is also configured with firewall policers. This first genuine packet received and inspected by sampled flow (sFlow) through a specific firewall policer will cause the device to reboot. After the reboot has completed if the device receives and sFlow inspects another genuine packet seen through a specific firewall policer the device will generate a core file and reboot. Continued inspection of these genuine packets will create an extended Denial of Service (DoS) condition. Depending on the method for service restoration e.g. hard boot or soft reboot a core file may or may not be generated the next time the packet is received and inspected by sFlow. This issue affects: Juniper Networks Junos OS 17.4 versions prior to 17.4R2-S9 17.4R3 on PTX1000 and PTX10000 Series QFX10000 Series; 18.1 versions prior to 18.1R3-S9 on PTX1000 and PTX10000 Series QFX10000 Series; 18.2X75 versions prior to 18.2X75-D12 18.2X75-D30 on PTX1000 and PTX10000 Series QFX10000 Series; 18.2 versions prior to 18.2R3 on PTX1000 and PTX10000 Series QFX10000 Series; 18.3 versions prior to 18.3R3 on PTX1000 and PTX10000 Series QFX10000 Series. This issue is not applicable to Junos OS versions before 17.4R1. This issue is not applicable to Junos OS Evolved or Junos OS with Advanced Forwarding Toolkit (AFT) forwarding implementations which use a different implementation of sFlow. The following example information is unrelated to this issue and is provided solely to assist you with determining if you have AFT or not. Example: A Junos OS device which supports the use of EVPN signaled VPWS with Flexible Cross Connect uses the AFT implementation. Since this configuration requires support and use of the AFT implementation to support this configuration the device is not vulnerable to this issue as the sFlow implementation is different using the AFT architecture. For further details about AFT visit the AFI / AFT are in the links below. If you are uncertain if you use the AFI/AFT implementation or not there are configuration examples in the links below which you may use to determine if you are vulnerable to this issue or not. If the commands work you are. If not you are not. You may also use the Feature Explorer to determine if AFI/AFT is supported or not. If you are still uncertain please contact your support resources.


An improper use of a validation framework when processing incoming genuine BGP packets within Juniper Networks RPD (routing protocols process) daemon allows an attacker to crash RPD thereby causing a Denial of Service (DoS) condition. This framework requires these packets to be passed. By continuously sending any of these types of formatted genuine packets an attacker can repeatedly crash the RPD process causing a sustained Denial of Service. Authentication to the BGP peer is not required. This issue can be initiated or propagated through eBGP and iBGP and can impact devices in either modes of use as long as the devices are configured to support the compromised framework and a BGP path is activated or active. This issue affects: Juniper Networks Junos OS 16.1 versions 16.1R7-S6 and later versions prior to 16.1R7-S8; 17.3 versions 17.3R2-S5 17.3R3-S6 and later versions prior to 17.3R3-S8; 17.4 versions 17.4R2-S7 17.4R3 and later versions prior to 17.4R2-S11 17.4R3-S2; 18.1 versions 18.1R3-S7 and later versions prior to 18.1R3-S10; 18.2 versions 18.2R2-S6 18.2R3-S2 and later versions prior to 18.2R2-S7 18.2R3-S5; 18.2X75 versions 18.2X75-D12 18.2X75-D32 18.2X75-D33 18.2X75-D51 18.2X75-D60 18.2X75-D411 18.2X75-D420 and later versions prior to 18.2X75-D32 18.2X75-D33 18.2X75-D420 18.2X75-D52 18.2X75-D60 18.2X75-D65 18.2X75-D70;(*1) 18.3 versions 18.3R1-S6 18.3R2-S3 18.3R3 and later versions prior to 18.3R2-S4 18.3R3-S2; 18.4 versions 18.4R1-S5 18.4R2-S4 18.4R3 and later versions prior to 18.4R1-S7 18.4R2-S5 18.4R3-S3(*2); 19.1 versions 19.1R1-S3 19.1R2 and later versions prior to 19.1R1-S5 19.1R2-S2 19.1R3-S2; 19.2 versions 19.2R1-S2 19.2R2 and later versions prior to 19.2R1-S5 19.2R2 19.2R3; 19.3 versions prior to 19.3R2-S3 19.3R3; 19.4 versions prior to 19.4R1-S2 19.4R2 19.4R3; 20.1 versions prior to 20.1R1-S1 20.1R2. This issue does not affect Junos OS prior to 16.1R1. This issue affects IPv4 and IPv6 traffic.


A

vulnerability

in

Juniper

Networks

Junos

OS

on

vMX

and

devices

may

allow

an

attacker

to

cause

a

Denial

of

Service

(DoS)

by

sending

specific

packets

requiring

special

processing

in

microcode

that

the

flow

cache

can't

handle

causing

the

riot

forwarding

daemon

to

crash.

By

continuously

sending

the

same

specific

packets

an

attacker

can

repeatedly

crash

the

riot

process

causing

a

sustained

Denial

of

Service.

Flow

cache

is

specific

to

vMX

based

products

and

the

and

is

enabled

by

default

in

performance

mode.

This

issue

can

only

be

triggered

by

traffic

destined

to

the

device.

Transit

traffic

will

not

cause

the

riot

daemon

to

crash.

When

the

issue

occurs

a

core

dump

and

riot

log

file

entry

are

generated.

For

example:

logs:

PANIC

in

PANIC

in

This

issue

affects

Juniper

Networks

Junos

OS:

versions

prior

to

on

vMX

and

versions

prior

to

on

vMX

and

versions

prior

to

on

vMX

and

versions

prior

to

on

vMX

and

versions

prior

to

on

vMX

and

versions

prior

to

on

vMX

and

This

issue

does

not

affect

Junos

OS

versions

prior

to


Receipt of a specifically malformed NDP packet sent from the local area network (LAN) to a device running Juniper Networks Junos OS Evolved can cause the ndp process to crash resulting in a Denial of Service (DoS). The process automatically restarts without intervention but a continuous receipt of the malformed NDP packets could leaded to an extended Denial of Service condition. During this time IPv6 neighbor learning will be affected. The issue occurs when parsing the incoming malformed NDP packet. Rather than simply discarding the packet the process asserts performing a controlled exit and restart thereby avoiding any chance of an unhandled exception. Exploitation of this vulnerability is limited to a temporary denial of service and cannot be leveraged to cause additional impact on the system. This issue is limited to the processing of IPv6 NDP packets. IPv4 packet processing cannot trigger and is unaffected by this vulnerability. This issue affects all Juniper Networks Junos OS Evolved versions prior to 20.1R2-EVO. Junos OS is unaffected by this vulnerability.


A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attempts resulting in a permanent leak of a socket connection by radosgw. This flaw could lead to a denial of service condition by pile up of CLOSE_WAIT sockets eventually leading to the exhaustion of available resources preventing legitimate users from connecting to the system.


When

a

device

running

Juniper

Networks

Junos

OS

with

or

line

cards

installed

and

the

system

is

configured

for

inline

IP

reassembly

used

by

MAP-E

GRE

and

IPIP

the

packet

forwarding

engine

(PFE)

will

become

disabled

upon

receipt

of

large

packets

requiring

fragmentation

generating

the

following

error

messages:

LOG:

Err

WO:

Packet

Error

Error

Packets

Connection

LOG:

Err

HMCIF

Rx:

Injected

checksum

error

detected

on

WO

response

Chunk

Address

LOG:

Err

DRD:

CMD

reorder

ID

error

Command

Reorder

ID

QID

LOG:

Err

DRD:

HMC

chunk

length

error

in

stage

Chunk

Address:

LOG:

Err

DRD:

HMC

chunk

address

error

in

stage

Chunk

Address:

LOG:

Notice

Error:

/fpc/8/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR

scope:

pfe

category:

functional

severity:

major

module:

type:

CMD

FSM

State

Error

LOG:

Notice

Performing

action

cmalarm

for

error

in

module:

with

scope:

pfe

category:

functional

level:

major

LOG:

Notice

Performing

action

get-state

for

error

in

module:

with

scope:

pfe

category:

functional

level:

major

LOG:

Notice

Performing

action

disable-pfe

for

error

in

module:

with

scope:

pfe

category:

functional

level:

major

By

continuously

sending

fragmented

packets

that

cannot

be

reassembled

an

attacker

can

repeatedly

disable

the

PFE

causing

a

sustained

Denial

of

Service

(DoS).

This

issue

affects

Juniper

Networks

Junos

OS:

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series.

This

issue

is

specific

to

inline

IP

reassembly

introduced

in

Junos

OS

Versions

of

Junos

OS

prior

to

are

unaffected

by

this

vulnerability.


On Juniper Networks MX series receipt of a stream of specific Layer 2 frames may cause a memory leak resulting in the packet forwarding engine (PFE) on the line card to crash and restart causing traffic interruption. By continuously sending this stream of specific layer 2 frame an attacker connected to the same broadcast domain can repeatedly crash the PFE causing a prolonged Denial of Service (DoS). This issue affects Juniper Networks Junos OS on MX Series: 17.2 versions prior to 17.2R3-S4; 17.2X75 versions prior to 17.2X75-D105.19; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R1-S3 17.4R2; 18.1 versions prior to 18.1R2. This issue does not affect Juniper Networks Junos OS releases prior to 17.2R1.


When DNS filtering is enabled on Juniper Networks Junos MX Series with one of the following cards MS-PIC MS-MIC or MS-MPC an incoming stream of packets processed by the Multiservices PIC Management Daemon (mspmand) process responsible for managing \URL Filtering service\ may crash causing the Services PIC to restart. While the Services PIC is restarting all PIC services including DNS filtering service (DNS sink holing) will be bypassed until the Services PIC completes its boot process. This vulnerability might allow an attacker to cause an extended Denial of Service (DoS) attack against the device and to cause clients to be vulnerable to DNS based attacks by malicious DNS servers when they send DNS requests through the device. As a result devices which were once protected by the DNS Filtering service are no longer protected and at risk of exploitation. This issue affects Juniper Networks Junos OS: 17.3 versions prior to 17.3R3-S8; 18.3 versions prior to 18.3R3-S1; 18.4 versions prior to 18.4R3; 19.1 versions prior to 19.1R3; 19.2 versions prior to 19.2R2; 19.3 versions prior to 19.3R3. This issue does not affect Juniper Networks Junos OS 17.4 18.1 and 18.2.


When

a

device

running

Juniper

Networks

Junos

OS

with

or

line

cards

installed

and

the

system

is

configured

for

inline

IP

reassembly

used

by

MAP-E

GRE

and

IPIP

the

packet

forwarding

engine

(PFE)

will

become

disabled

upon

receipt

of

small

fragments

requiring

reassembly

generating

the

following

error

messages:

LOG:

Err

WO:

Packet

Error

Error

Packets

Connection

LOG:

Err

HMCIF

Rx:

Injected

checksum

error

detected

on

WO

response

Chunk

Address

LOG:

Err

DRD:

CMD

reorder

ID

error

Command

Reorder

ID

QID

LOG:

Err

DRD:

HMC

chunk

address

error

in

stage

Chunk

Address:

LOG:

Notice

Error:

/fpc/0/pfe/0/cm/0/MQSS(2)/2/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR

scope:

pfe

category:

functional

severity:

major

module:

type:

CMD

FSM

State

Error

LOG:

Notice

Performing

action

cmalarm

for

error

in

module:

with

scope:

pfe

category:

functional

level:

major

LOG:

Notice

Performing

action

get-state

for

error

in

module:

with

scope:

pfe

category:

functional

level:

major

LOG:

Notice

Performing

action

disable-pfe

for

error

in

module:

with

scope:

pfe

category:

functional

level:

major

By

continuously

sending

fragmented

packets

that

cannot

be

reassembled

an

attacker

can

repeatedly

disable

the

PFE

causing

a

sustained

Denial

of

Service

(DoS).

This

issue

affects

Juniper

Networks

Junos

OS:

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series;

versions

prior

to

on

MX

Series.

This

issue

is

specific

to

inline

IP

reassembly

introduced

in

Junos

OS

Versions

of

Junos

OS

prior

to

are

unaffected

by

this

vulnerability.


FusionAccess with versions earlier than 6.5.1.SPC002 have a Denial of Service (DoS) vulnerability. Due to insufficient verification on specific input attackers can exploit this vulnerability by sending constructed messages to the affected device through another device on the same network. Successful exploit could cause affected devices to be abnormal.


Due to a new NDP proxy feature for EVPN leaf nodes introduced in Junos OS 17.4 crafted NDPv6 packets could transit a Junos device configured as a Broadband Network Gateway (BNG) and reach the EVPN leaf node causing a stale MAC address entry. This could cause legitimate traffic to be discarded leading to a Denial of Service (DoS) condition. This issue only affects Junos OS 17.4 and later releases. Prior releases do not support this feature and are unaffected by this vulnerability. This issue only affects IPv6. IPv4 ARP proxy is unaffected by this vulnerability. This issue affects Juniper Networks Junos OS: 17.4 versions prior to 17.4R2-S9 17.4R3 on MX Series; 18.1 versions prior to 18.1R3-S9 on MX Series; 18.2 versions prior to 18.2R2-S7 18.2R3-S3 on MX Series; 18.2X75 versions prior to 18.2X75-D33 18.2X75-D411 18.2X75-D420 18.2X75-D60 on MX Series; 18.3 versions prior to 18.3R1-S7 18.3R2-S3 18.3R3 on MX Series; 18.4 versions prior to 18.4R1-S5 18.4R2-S2 18.4R3 on MX Series; 19.1 versions prior to 19.1R1-S4 19.1R2 on MX Series; 19.2 versions prior to 19.2R1-S3 19.2R2 on MX Series.


A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU version >= v5.0. Virtio-fs is meant to share a host file system directory with a guest via virtio-fs device. If the guest opens the maximum number of file descriptors under the shared directory a denial of service may occur. This flaw allows a guest user/process to cause this denial of service on the host.


A vulnerability in Cisco IOS XE Software could allow an unauthenticated adjacent attacker to cause a device to reload. The vulnerability is due to incorrect handling of certain valid but not typical Ethernet frames. An attacker could exploit this vulnerability by sending the Ethernet frames onto the Ethernet segment. A successful exploit could allow the attacker to cause the device to reload resulting in a denial of service (DoS) condition.


A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to upload arbitrary-sized files to specific folders on an affected device which could lead to an unexpected device reload. The vulnerability exists because the affected software does not efficiently handle the writing of large files to specific folders on the local file system. An attacker could exploit this vulnerability by uploading files to those specific folders. A successful exploit could allow the attacker to write a file that triggers a watchdog timeout which would cause the device to unexpectedly reload causing a denial of service (DoS) condition.


Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated adjacent attacker to cause a denial of service (DoS) condition of an affected device. These vulnerabilities are due to insufficient validation of CAPWAP packets. An attacker could exploit these vulnerabilities by sending a malformed CAPWAP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to crash and reload resulting in a DoS condition on the affected device.


A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to inefficient memory management. An attacker could exploit this vulnerability by sending a high rate of IPv4 or IPv6 traffic through an affected device. This traffic would need to match a configured block action in an access control policy. An exploit could allow the attacker to cause a memory exhaustion condition on the affected device which would result in a DoS for traffic transiting the device as well as sluggish performance of the management interface. Once the flood is stopped performance should return to previous states.


A vulnerability in the RESTCONF and NETCONF-YANG access control list (ACL) function of Cisco IOS XE Software could allow an unauthenticated remote attacker to cause the device to reload. The vulnerability is due to incorrect processing of the ACL that is tied to the RESTCONF or NETCONF-YANG feature. An attacker could exploit this vulnerability by accessing the device using RESTCONF or NETCONF-YANG. A successful exploit could allow an attacker to cause the device to reload resulting in a denial of service (DoS) condition.


A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to inefficient memory management. An attacker could exploit this vulnerability by sending a large number of TCP packets to a specific port on an affected device. A successful exploit could allow the attacker to exhaust system memory which could cause the device to reload unexpectedly. No manual intervention is needed to recover the device after it has reloaded.


A vulnerability in the OSPF Version 2 (OSPFv2) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to cause an affected device to reload resulting in a denial of service (DoS) condition. The vulnerability is due to incomplete input validation when the affected software processes certain OSPFv2 packets with Link-Local Signaling (LLS) data. An attacker could exploit this vulnerability by sending a malformed OSPFv2 packet to an affected device. A successful exploit could allow the attacker to cause an affected device to reload resulting in a DoS condition.


A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of requests sent to the web interface. An attacker could exploit this vulnerability by sending a malicious request to the web interface of an affected device. A successful exploit could allow the attacker to cause an unexpected reload of the device resulting in a DoS condition. This vulnerability affects firmware releases prior than 1.3.7.18


A vulnerability in the Session Initiation Protocol (SIP) of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect handling of incoming SIP traffic. An attacker could exploit this vulnerability by sending a series of SIP packets to an affected device. A successful exploit could allow the attacker to exhaust memory on an affected device causing it to crash and leading to a DoS condition.


A vulnerability in the Cisco Discovery Protocol of Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated adjacent attacker to cause a memory leak which could lead to a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect processing of certain Cisco Discovery Protocol packets. An attacker could exploit this vulnerability by sending certain Cisco Discovery Protocol packets to an affected device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory which could cause the device to crash and reload resulting in a DOS condition. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).


A vulnerability in the management REST API of Cisco Industrial Network Director (IND) could allow an authenticated remote attacker to cause the CPU utilization to increase to 100 percent resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient validation of requests sent to the REST API. An attacker could exploit this vulnerability by sending a crafted request to the REST API. A successful exploit could allow the attacker to cause a permanent DoS condition that is due to high CPU utilization. Manual intervention may be required to recover the Cisco IND.


A vulnerability in the Border Gateway Protocol (BGP) Multicast VPN (MVPN) implementation of Cisco NX-OS Software could allow an unauthenticated remote attacker to cause an affected device to unexpectedly reload resulting in a denial of service (DoS) condition. The vulnerability is due to incomplete input validation of a specific type of BGP MVPN update message. An attacker could exploit this vulnerability by sending this specific valid BGP MVPN update message to a targeted device. A successful exploit could allow the attacker to cause one of the BGP-related routing applications to restart multiple times leading to a system-level restart. Note: The Cisco implementation of BGP accepts incoming BGP traffic from only explicitly configured peers. To exploit this vulnerability an attacker must send a specific BGP MVPN update message over an established TCP connection that appears to come from a trusted BGP peer. To do so the attacker must obtain information about the BGP peers in the trusted network of the affected system.


A vulnerability in the implementation of Multiprotocol Border Gateway Protocol (MP-BGP) for the Layer 2 VPN (L2VPN) Ethernet VPN (EVPN) address family in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to incorrect processing of Border Gateway Protocol (BGP) update messages that contain crafted EVPN attributes. An attacker could exploit this vulnerability by sending BGP update messages with specific malformed attributes to an affected device. A successful exploit could allow the attacker to cause an affected device to crash resulting in a DoS condition.


A vulnerability in Cisco Aironet Series Access Points Software could allow an unauthenticated adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to the improper processing of client packets that are sent to an affected access point (AP). An attacker could exploit this vulnerability by sending a large number of sustained client packets to the affected AP. A successful exploit could allow the attacker to cause the affected AP to crash resulting in a DoS condition.


A vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to cause an affected device to reload unexpectedly resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition. Note: This vulnerability applies to IP Version 4 (IPv4) and IP Version 6 (IPv6) HTTP traffic.


Multiple vulnerabilities in the web management framework of Cisco IOS XE Software could allow an authenticated remote attacker with read-only privileges to gain unauthorized read access to sensitive data or cause the web management software to hang or crash resulting in a denial of service (DoS) condition. For more information about these vulnerabilities see the Details section of this advisory.


A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated remote attacker to consume excessive system memory and cause a denial of service (DoS) condition on an affected system. The vulnerability is due to inefficient memory management. An attacker could exploit this vulnerability by sending a large number of crafted HTTP requests to the affected web-based management interface. A successful exploit could allow the attacker to exhaust system memory which could cause the system to stop processing new connections and could result in a DoS condition.


A vulnerability in the implementation of the Low Power Wide Area (LPWA) subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could allow an unauthenticated remote attacker to gain unauthorized read access to sensitive data or cause a denial of service (DoS) condition. The vulnerability is due to a lack of input and validation checking mechanisms for virtual-LPWA (VLPWA) protocol modem messages. An attacker could exploit this vulnerability by supplying crafted packets to an affected device. A successful exploit could allow the attacker to gain unauthorized read access to sensitive data or cause the VLPWA interface of the affected device to shut down resulting in DoS condition.


A vulnerability in the DHCP message handler of Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated remote attacker to cause the supervisor to crash which could result in a denial of service (DoS) condition. The vulnerability is due to insufficient error handling when DHCP version 4 (DHCPv4) messages are parsed. An attacker could exploit this vulnerability by sending a malicious DHCPv4 message to or through a WAN interface of an affected device. A successful exploit could allow the attacker to cause a reload of the affected device. Note: On Cisco cBR-8 Converged Broadband Routers all of the following are considered WAN interfaces: 10 Gbps Ethernet interfaces 100 Gbps Ethernet interfaces Port channel interfaces that include multiple 10 and/or 100 Gbps Ethernet interfaces


A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting in a Denial of service (DoS) condition for the player application on an affected system. The vulnerability exists due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to cause the Webex player application to crash when trying to view the malicious file.


A vulnerability in the ingress packet processing path of Cisco Firepower Threat Defense (FTD) Software for interfaces that are configured either as Inline Pair or in Passive mode could allow an unauthenticated adjacent attacker to cause a denial of service (DoS) condition. The vulnerability is due to insufficient validation when Ethernet frames are processed. An attacker could exploit this vulnerability by sending malicious Ethernet frames through an affected device. A successful exploit could allow the attacker do either of the following: Fill the /ngfw partition on the device: A full /ngfw partition could result in administrators being unable to log in to the device (including logging in through the console port) or the device being unable to boot up correctly. Note: Manual intervention is required to recover from this situation. Customers are advised to contact the Cisco Technical Assistance Center (TAC) to help recover a device in this condition. Cause a process crash: The process crash would cause the device to reload. No manual intervention is necessary to recover the device after the reload.


A vulnerability in the IP Service Level Agreement (SLA) responder feature of Cisco IOS XE Software could allow an unauthenticated remote attacker to cause the IP SLA responder to reuse an existing port resulting in a denial of service (DoS) condition. The vulnerability exists because the IP SLA responder could consume a port that could be used by another feature. An attacker could exploit this vulnerability by sending specific IP SLA control packets to the IP SLA responder on an affected device. The control packets must include the port number that could be used by another configured feature. A successful exploit could allow the attacker to cause an in-use port to be consumed by the IP SLA responder impacting the feature that was using the port and resulting in a DoS condition.


A vulnerability in the Live Data server of Cisco Unified Contact Center Enterprise could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists because the affected software improperly manages resources when processing inbound Live Data traffic. An attacker could exploit this vulnerability by sending multiple crafted Live Data packets to an affected device. A successful exploit could cause the affected device to run out of buffer resources which could result in a stack overflow and cause the affected device to reload resulting in a DoS condition. Note: The Live Data port in Cisco Unified Contact Center Enterprise devices allows only a single TCP connection. To exploit this vulnerability an attacker would have to send crafted packets to an affected device before a legitimate Live Data client establishes a connection.


A vulnerability in the Session Initiation Protocol (SIP) library of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated remote attacker to trigger a reload of an affected device resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient sanity checks on received SIP messages. An attacker could exploit this vulnerability by sending crafted SIP messages to an affected device. A successful exploit could allow the attacker to cause the affected device to reload resulting in a denial of service condition.


A vulnerability in the IP fragment-handling implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to cause a memory leak on an affected device. This memory leak could prevent traffic from being processed through the device resulting in a denial of service (DoS) condition. The vulnerability is due to improper error handling when specific failures occur during IP fragment reassembly. An attacker could exploit this vulnerability by sending crafted fragmented IP traffic to a targeted device. A successful exploit could allow the attacker to continuously consume memory on the affected device and eventually impact traffic resulting in a DoS condition. The device could require a manual reboot to recover from the DoS condition. Note: This vulnerability applies to both IP Version 4 (IPv4) and IP Version 6 (IPv6) traffic.


A vulnerability in the Protocol Independent Multicast (PIM) feature for IPv6 networks (PIM6) of Cisco NX-OS Software could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper error handling when processing inbound PIM6 packets. An attacker could exploit this vulnerability by sending multiple crafted PIM6 packets to an affected device. A successful exploit could allow the attacker to cause the PIM6 application to leak system memory. Over time this memory leak could cause the PIM6 application to stop processing legitimate PIM6 traffic leading to a DoS condition on the affected device.


A vulnerability in the Cisco Discovery Protocol of Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated adjacent attacker to cause a memory leak which could lead to a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect processing of certain Cisco Discovery Protocol packets. An attacker could exploit this vulnerability by sending certain Cisco Discovery Protocol packets to an affected device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory which could cause the device to crash and reload resulting in a DOS condition. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).


The Windows Logon installer prior to 4.1.2 did not properly validate file installation paths. This allows an attacker with local user privileges to coerce the installer to write to arbitrary privileged directories. If successful an attacker can manipulate files used by Windows Logon cause Denial of Service (DoS) by deleting file(s) or replace system files to potentially achieve elevation of privileges. Note that this can only exploitable during new installations while the installer is running and is not exploitable once installation is finished. Versions 4.1.2 of Windows Logon addresses this issue.


A vulnerability in the SSL/TLS session handler of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a memory leak when closing SSL/TLS connections in a specific state. An attacker could exploit this vulnerability by establishing several SSL/TLS sessions and ensuring they are closed under certain conditions. A successful exploit could allow the attacker to exhaust memory resources in the affected device which would prevent it from processing new SSL/TLS connections resulting in a DoS. Manual intervention is required to recover an affected device.