CVE-2017-10610 : What You Need to Know
Discover the impact of CVE-2017-10610 on Juniper Networks SRX Series devices running Junos OS. Learn about the vulnerability, affected versions, and mitigation steps.
On October 11, 2017, Juniper Networks published CVE-2017-10610 regarding a vulnerability affecting SRX Series devices running Junos OS. The issue involves the flowd process crashing due to a specially crafted ICMP packet within a NAT64 IPv6 to IPv4 tunnel.
Understanding CVE-2017-10610
This CVE highlights a denial of service risk on SRX Series devices when NAT64 is enabled.
What is CVE-2017-10610?
The flowd process on SRX Series devices may crash if a carefully crafted ICMP packet is found within a NAT64 IPv6 to IPv4 tunnel, leading to a prolonged denial of service situation.
The Impact of CVE-2017-10610
- CVSS Base Score: 7.5 (High Severity)
- Attack Vector: Network
- Availability Impact: High
- No Confidentiality or Integrity Impact
Technical Details of CVE-2017-10610
This section provides more in-depth technical insights into the vulnerability.
Vulnerability Description
The flowd process on SRX Series devices crashes when encountering a specific ICMP packet in a NAT64 IPv6 to IPv4 tunnel, potentially causing a denial of service.
Affected Systems and Versions
- Affected Platforms: SRX Series
- Affected Product: Junos OS
- Vulnerable Versions:
- 12.1X46 prior to 12.1X46-D71
- 12.3X48 prior to 12.3X48-D55
- 15.1X49 prior to 15.1X49-D100
Exploitation Mechanism
The issue arises when a malicious ICMP packet is embedded within a NAT64 IPv6 to IPv4 tunnel, triggering repeated crashes of the flowd process.
Mitigation and Prevention
Protecting systems from CVE-2017-10610 involves immediate actions and long-term security practices.
Immediate Steps to Take
- Update affected Junos OS versions to the patched releases.
- Disable NAT64 if not essential to operations.
Long-Term Security Practices
- Regularly monitor and apply security updates.
- Implement network segmentation to contain potential vulnerabilities.
Patching and Updates
- Juniper Networks released fixed versions: 12.1X46-D71, 12.3X48-D55, 15.1X49-D100, 17.3R1, and later.
- Refer to PR 1270680 on the Customer Support website for more details.