Vulnerability Details : CVE-2014-2714
The Enhanced Web Filtering (EWF) in Juniper Junos before 10.4R15, 11.4 before 11.4R9, 12.1 before 12.1R7, 12.1X44 before 12.1X44-D20, 12.1X45 before 12.1X45-D10, and 12.1X46 before 12.1X46-D10, as used in the SRX Series services gateways, allows remote attackers to cause a denial of service (flow daemon crash and restart) via a crafted URL.
Vulnerability category: Input validationDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2014-2714
Probability of exploitation activity in the next 30 days: 0.69%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 78 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2014-2714
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.1
|
HIGH | AV:N/AC:M/Au:N/C:N/I:N/A:C |
8.6
|
6.9
|
NIST |
CWE ids for CVE-2014-2714
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-2714
-
http://www.securityfocus.com/bid/66760
Juniper Junos SRX Series Enhanced Web Filtering CVE-2014-2714 Denial of Service Vulnerability
-
http://securitytracker.com/id?1030060
Juniper Junos SRX Series Enhanced Web Filtering Bug Lets Remote Users Deny Service - SecurityTracker
-
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10622
Juniper Networks - 2014-04 Security Bulletin: Junos: SRX Series Enhanced Web Filtering flowd crash while parsing URL (CVE-2014-2714)Vendor Advisory
Products affected by CVE-2014-2714
- cpe:2.3:o:juniper:junos:10.4:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:11.4:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:12.1:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:12.1x44:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:12.1x45:*:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:12.1x46:*:*:*:*:*:*:*