Vulnerabilities

<br /> <br /> <br /> <br /> <br /> An Improper Handling of Syntactically Invalid Structure vulnerability in Object Flooding Protocol (OFP) service of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).<br /> <br /> On all Junos OS Evolved platforms, when specific TCP packets are received on an open OFP port, the OFP crashes leading to a restart of Routine Engine (RE). Continuous receipt of these specific TCP packets will lead to a sustained Denial of Service (DoS) condition.<br /> <br /> <br /> <br /> <br /> <br /> This issue affects:<br /> <br /> Juniper Networks Junos OS Evolved<br /> <br /> <br /> <br /> * All versions earlier than 21.2R3-S7-EVO;<br /> * 21.3 versions earlier than 21.3R3-S5-EVO ;<br /> * 21.4 versions earlier than 21.4R3-S5-EVO;<br /> * 22.1 versions earlier than 22.1R3-S4-EVO;<br /> * 22.2 versions earlier than 22.2R3-S3-EVO ;<br /> * 22.3 versions earlier than 22.3R3-EVO;<br /> * 22.4 versions earlier than 22.4R2-EVO, 22.4R3-EVO.<br /> <br /> <br /> <br /> <br /> <br /> <br />

<br /> A Missing Release of Memory after Effective Lifetime vulnerability in Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause an rpd crash, leading to Denial of Service (DoS).<br /> <br /> On all Junos OS and Junos OS Evolved platforms, when traffic engineering is enabled for OSPF or ISIS, and a link flaps, a patroot memory leak is observed. This memory leak, over time, will lead to an rpd crash and restart.<br /> <br /> The memory usage can be monitored using the below command.<br /> <br /> user@host&gt; show task memory detail | match patroot<br /> This issue affects:<br /> <br /> Juniper Networks Junos OS<br /> <br /> <br /> <br /> * All versions earlier than 21.2R3-S3;<br /> * 21.3 versions earlier than 21.3R3-S5;<br /> * 21.4 versions earlier than 21.4R3-S3;<br /> * 22.1 versions earlier than 22.1R3;<br /> * 22.2 versions earlier than 22.2R3.<br /> <br /> <br /> <br /> <br /> Juniper Networks Junos OS Evolved<br /> <br /> <br /> <br /> * All versions earlier than 21.3R3-S5-EVO;<br /> * 21.4 versions earlier than 21.4R3-EVO;<br /> * 22.1 versions earlier than 22.1R3-EVO;<br /> * 22.2 versions earlier than 22.2R3-EVO.<br /> <br /> <br /> <br /> <br /> <br /> <br />

<br /> An Improper Check for Unusual or Exceptional Conditions vulnerability in Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based, unauthenticated attacker to cause rpd to crash, leading to Denial of Service (DoS).<br /> <br /> On all Junos OS and Junos OS Evolved platforms, when NETCONF and gRPC are enabled, and a specific query is executed via Dynamic Rendering (DREND), rpd will crash and restart. Continuous execution of this specific query will cause a sustained Denial of Service (DoS) condition.<br /> <br /> This issue affects:<br /> <br /> Juniper Networks Junos OS<br /> <br /> <br /> <br /> * 22.2 versions earlier than 22.2R2-S2, 22.2R3;<br /> * 22.3 versions earlier than 22.3R2, 22.3R3.<br /> <br /> <br /> <br /> <br /> Juniper Networks Junos OS Evolved<br /> <br /> <br /> <br /> * 22.2 versions earlier than 22.2R2-S2-EVO, 22.2R3-EVO;<br /> * 22.3 versions earlier than 22.3R2-EVO, 22.3R3-EVO.<br /> <br /> <br /> <br /> <br /> This issue does not affect Juniper Networks:<br /> <br /> Junos OS versions earlier than 22.2R1;<br /> <br /> Junos OS Evolved versions earlier than 22.2R1-EVO.<br /> <br /> <br /> <br />

<br /> A Concurrent Execution using Shared Resource with Improper Synchronization (&amp;#39;Race Condition&amp;#39;) vulnerability in the Flow-processing Daemon (flowd) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (Dos).<br /> <br /> On SRX Series devices when two different threads try to simultaneously process a queue which is used for TCP events flowd will crash. One of these threads can not be triggered externally, so the exploitation of this race condition is outside the attackers direct control.<br /> <br /> Continued exploitation of this issue will lead to a sustained DoS.<br /> <br /> This issue affects Juniper Networks Junos OS:<br /> <br /> <br /> <br /> * 21.2 versions earlier than 21.2R3-S5;<br /> * 21.3 versions earlier than 21.3R3-S5;<br /> * 21.4 versions earlier than 21.4R3-S4;<br /> * 22.1 versions earlier than 22.1R3-S3;<br /> * 22.2 versions earlier than 22.2R3-S1;<br /> * 22.3 versions earlier than 22.3R2-S2, 22.3R3;<br /> * 22.4 versions earlier than 22.4R2-S1, 22.4R3.<br /> <br /> <br /> <br /> <br /> This issue does not affect Juniper Networks Junos OS versions earlier than 21.2R1.<br /> <br /> <br /> <br />

<br /> A NULL Pointer Dereference vulnerability in Juniper Networks Junos OS Evolved on ACX7024, ACX7100-32C and ACX7100-48L allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).<br /> <br /> If a specific IPv4 UDP packet is received and sent to the Routing Engine (RE) packetio crashes and restarts which causes a momentary traffic interruption. Continued receipt of such packets will lead to a sustained DoS.<br /> <br /> This issue does not happen with IPv6 packets.<br /> <br /> This issue affects Juniper Networks Junos OS Evolved on ACX7024, ACX7100-32C and ACX7100-48L:<br /> <br /> <br /> <br /> * 21.4-EVO versions earlier than 21.4R3-S6-EVO;<br /> * 22.1-EVO versions earlier than 22.1R3-S5-EVO;<br /> * 22.2-EVO versions earlier than 22.2R2-S1-EVO, 22.2R3-EVO;<br /> * 22.3-EVO versions earlier than 22.3R2-EVO.<br /> <br /> <br /> <br /> <br /> This issue does not affect Juniper Networks Junos OS Evolved versions earlier than 21.4R1-EVO.<br /> <br /> <br /> <br />

<br /> An Improper Check for Unusual or Exceptional Conditions vulnerability in the kernel of Juniper Network Junos OS on MX Series allows a network based attacker with low privileges to cause a denial of service.<br /> <br /> If a scaled configuration for Source class usage (SCU) / destination class usage (DCU) (more than 10 route classes) is present and the SCU/DCU statistics are gathered by executing specific SNMP requests or CLI commands, a &amp;#39;vmcore&amp;#39; for the RE kernel will be seen which leads to a device restart. Continued exploitation of this issue will lead to a sustained DoS.<br /> <br /> This issue only affects MX Series devices with MPC10, MPC11 or LC9600, and MX304. No other MX Series devices are affected.<br /> <br /> This issue affects Juniper Networks Junos OS:<br /> <br /> <br /> <br /> * All versions earlier than 20.4R3-S9;<br /> * 21.2 versions earlier than 21.2R3-S6;<br /> * 21.3 versions earlier than 21.3R3-S5;<br /> * 21.4 versions earlier than 21.4R3;<br /> * 22.1 versions earlier than 22.1R3;<br /> * 22.2 versions earlier than 22.2R2;<br /> * 22.3 versions earlier than 22.3R2.<br /> <br /> <br /> <br /> <br /> <br /> <br />

<br /> An Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).<br /> <br /> If a high rate of specific valid packets are processed by the routing engine (RE) this will lead to a loss of connectivity of the RE with other components of the chassis and thereby a complete and persistent system outage. Please note that a carefully designed lo0 firewall filter will block or limit these packets which should prevent this issue from occurring.<br /> <br /> The following log messages can be seen when this issue occurs:<br /> <br /> kernel: nf_conntrack: nf_conntrack: table full, dropping packet<br /> This issue affects Juniper Networks Junos OS Evolved:<br /> <br /> <br /> <br /> * All versions earlier than 20.4R3-S7-EVO;<br /> * 21.2R1-EVO and later versions;<br /> * 21.4-EVO versions earlier than 21.4R3-S5-EVO;<br /> * 22.1-EVO versions earlier than 22.1R3-S2-EVO;<br /> * 22.2-EVO versions earlier than 22.2R3-EVO;<br /> * 22.3-EVO versions earlier than 22.3R2-EVO;<br /> * 22.4-EVO versions earlier than 22.4R2-EVO.<br /> <br /> <br /> <br /> <br /> <br /> <br />

<br /> A Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS).<br /> <br /> In a remote access VPN scenario, if a "tcp-encap-profile" is configured and a sequence of specific packets is received, a flowd crash and restart will be observed.<br /> <br /> This issue affects Juniper Networks Junos OS on SRX Series:<br /> <br /> <br /> <br /> * All versions earlier than 20.4R3-S8;<br /> * 21.2 versions earlier than 21.2R3-S6;<br /> * 21.3 versions earlier than 21.3R3-S5;<br /> * 21.4 versions earlier than 21.4R3-S5;<br /> * 22.1 versions earlier than 22.1R3-S3;<br /> * 22.2 versions earlier than 22.2R3-S3;<br /> * 22.3 versions earlier than 22.3R3-S1;<br /> * 22.4 versions earlier than 22.4R2-S2, 22.4R3.<br /> <br /> <br /> <br /> <br /> <br /> <br />

<br /> An Improper Validation of Syntactic Correctness of Input vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS).<br /> <br /> If an attacker sends high rate of specific ICMP traffic to a device with VXLAN configured, this causes a deadlock of the PFE and results in the device becoming unresponsive. A manual restart will be required to recover the device.<br /> <br /> This issue only affects EX4100, EX4400, EX4600, QFX5000 Series devices.<br /> <br /> This issue affects:<br /> <br /> Juniper Networks Junos OS<br /> <br /> <br /> <br /> * 21.4R3 versions earlier than 21.4R3-S4;<br /> * 22.1R3 versions earlier than 22.1R3-S3;<br /> * 22.2R2 versions earlier than 22.2R3-S1;<br /> * 22.3 versions earlier than 22.3R2-S2, 22.3R3;<br /> * 22.4 versions earlier than 22.4R2;<br /> * 23.1 versions earlier than 23.1R2.<br /> <br /> <br /> <br /> <br /> <br /> <br />

<br /> A Heap-based Buffer Overflow vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS).<br /> <br /> If an attacker sends a specific BGP UPDATE message to the device, this will cause a memory overwrite and therefore an RPD crash and restart in the backup Routing Engine (RE). Continued receipt of these packets will cause a sustained Denial of Service (DoS) condition in the backup RE.<br /> <br /> The primary RE is not impacted by this issue and there is no impact on traffic.<br /> <br /> This issue only affects devices with NSR enabled.<br /> <br /> Note: NSR is not supported on the SRX Series and is therefore not affected by this vulnerability.<br /> This issue requires an attacker to have an established BGP session to a system affected by the issue. This issue affects both eBGP and iBGP implementations.<br /> <br /> This issue affects:<br /> <br /> Juniper Networks Junos OS<br /> <br /> <br /> <br /> * All versions earlier than 20.4R3-S9;<br /> * 21.2 versions earlier than 21.2R3-S7;<br /> * 21.3 versions earlier than 21.3R3-S5;<br /> * 21.4 versions earlier than 21.4R3-S5;<br /> * 22.1 versions earlier than 22.1R3-S4;<br /> * 22.2 versions earlier than 22.2R3-S2;<br /> * 22.3 versions earlier than 22.3R3-S1;<br /> * 22.4 versions earlier than 22.4R2-S2, 22.4R3;<br /> * 23.1 versions earlier than 23.1R2;<br /> * 23.2 versions earlier than 23.2R1-S2, 23.2R2.<br /> <br /> <br /> <br /> <br /> Juniper Networks Junos OS Evolved<br /> <br /> <br /> <br /> * All versions earlier than 21.3R3-S5-EVO;<br /> * 21.4-EVO versions earlier than 21.4R3-S5-EVO;<br /> * 22.1-EVO versions earlier than 22.1R3-S4-EVO;<br /> * 22.2-EVO versions earlier than 22.2R3-S2-EVO;<br /> * 22.3-EVO versions later than 22.3R1-EVO;<br /> * 22.4-EVO versions earlier than 22.4R2-S2-EVO, 22.4R3-EVO;<br /> * 23.1-EVO versions earlier than 23.1R2-EVO;<br /> * 23.2-EVO versions earlier than 23.2R1-S2-EVO, 23.2R2-EVO.<br /> <br /> <br /> <br /> <br /> <br /> <br />

<br /> An Exposure of Resource to Wrong Sphere vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass the intended access restrictions.<br /> <br /> In an Abstracted Fabric (AF) scenario if routing-instances (RI) are configured, specific valid traffic destined to the device can bypass the configured lo0 firewall filters as it&amp;#39;s received in the wrong RI context.<br /> <br /> This issue affects Juniper Networks Junos OS on MX Series:<br /> <br /> <br /> <br /> * All versions earlier than 20.4R3-S9;<br /> * 21.2 versions earlier than 21.2R3-S3;<br /> * 21.4 versions earlier than 21.4R3-S5;<br /> * 22.1 versions earlier than 22.1R3;<br /> * 22.2 versions earlier than 22.2R3;<br /> * 22.3 versions earlier than 22.3R2.<br /> <br /> <br /> <br /> <br /> <br /> <br />

<br /> A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).<br /> <br /> If an MX Series device receives PTP packets on an MPC3E that doesn&amp;#39;t support PTP this causes a memory leak which will result in unpredictable behavior and ultimately in an MPC crash and restart.<br /> <br /> To monitor for this issue, please use the following FPC vty level commands:<br /> <br /> show heap<br /> shows an increase in "LAN buffer" utilization and<br /> <br /> show clksync ptp nbr-upd-info<br /> shows non-zero "Pending PFEs" counter.<br /> <br /> This issue affects Juniper Networks Junos OS on MX Series with MPC3E:<br /> <br /> <br /> <br /> * All versions earlier than 20.4R3-S3;<br /> * 21.1 versions earlier than 21.1R3-S4;<br /> * 21.2 versions earlier than 21.2R3;<br /> * 21.3 versions earlier than 21.3R2-S1, 21.3R3;<br /> * 21.4 versions earlier than 21.4R2;<br /> * 22.1 versions earlier than 22.1R2.<br /> <br /> <br /> <br /> <br /> <br /> <br />