CVE-2017-2317 Denial of service in NorthStar Controller Application

What is CVE-2017-2317?

CVE-2017-2317 is a high-severity denial of service vulnerability in Juniper Networks NorthStar Controller Application, published on 24 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unprivileged, network-based attacker to cause denials of services to underlying database tables leading to potential information disclosure, modification of system states, and partial to full denial of services relying upon data modified by an attacker.

Weakness: CWE-200

Which versions are affected by CVE-2017-2317?

It affects 1 product.

Products include Juniper Northstar Controller.

How do I fix CVE-2017-2317?

No fix has been published for CVE-2017-2317 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2017-2317 being exploited?

There is no known exploitation of CVE-2017-2317 in the wild and no public exploit code.

Other vulnerabilities in Juniper Networks NorthStar Controller Application

• CVE-2017-2320 Information disclosure in NorthStar Controller Application Critical 10.0
• CVE-2017-2332 Auth bypass in NorthStar Controller Application High 8.8
• CVE-2017-2321 Other in NorthStar Controller Application High 8.6
• CVE-2017-2319 Auth bypass in NorthStar Controller Application High 8.3
• CVE-2017-2323 Denial of service in NorthStar Controller Application High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8g9g-j6p5-3x9c.