CVE-2020-1602: Junos OS and Junos OS Evolved: A vulnerability in JDHCPD allows an attacker to send crafted IPv4 packets may take over the code execution of the JDHCPD process.
When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay mode it vulnerable to an attacker sending crafted IPv4 packets who may remotely take over the code execution of the JDHDCP process. This issue affect IPv4 JDHCPD services. This issue affects: Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S6; 15.1X49 versions prior to 15.1X49-D200; 15.1X53 versions prior to 15.1X53-D592; 16.1 versions prior to 16.1R7-S6; 16.2 versions prior to 16.2R2-S11; 17.1 versions prior to 17.1R2-S11, 17.1R3-S1; 17.2 versions prior to 17.2R2-S8, 17.2R3-S3; 17.3 versions prior to 17.3R3-S6; 17.4 versions prior to 17.4R2-S7, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3-S2; 18.2X75 versions prior to 18.2X75-D60; 18.3 versions prior to 18.3R1-S6, 18.3R2-S2, 18.3R3; 18.4 versions prior to 18.4R1-S5, 18.4R2-S3, 18.4R3; 19.1 versions prior to 19.1R1-S3, 19.1R2; 19.2 versions prior to 19.2R1-S3, 19.2R2. and All versions prior to 19.3R1 on Junos OS Evolved. This issue do not affect versions of Junos OS prior to 15.1, or JDHCPD operating as a local server in non-relay mode.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Junos OS Evolvedto a version that resolves this vulnerability.Fixed in 19.3R1 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 15.1R7-S6 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 15.1X49-D200 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 15.1X53-D592 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 16.1R7-S6 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 16.2R2-S11 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 17.1R2-S11 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 17.1R3-S1 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 17.2R2-S8 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 17.2R3-S3 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 17.3R3-S6 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 17.4R2-S7 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 17.4R3 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 18.1R3-S8 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 18.2R3-S2 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 18.2X75-D60 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 18.3R1-S6 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 18.3R2-S2 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 18.3R3 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 18.4R1-S5 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 18.4R2-S3 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 18.4R3 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 19.1R1-S3 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 19.1R2 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 19.2R1-S3 - Upgrade
Upgrade
Junos OSto a version that resolves this vulnerability.Fixed in 19.2R2*
Event History
Frequently Asked Questions
What is the severity of CVE-2020-1602?
CVE-2020-1602 has been classified with a CVSS score that indicates a critical severity, allowing remote code execution through crafted IPv4 packets.
How do I fix CVE-2020-1602?
To remediate CVE-2020-1602, Juniper Networks advises upgrading to the latest patched version of the Junos OS as specified in their security advisories.
What versions of Junos OS are affected by CVE-2020-1602?
CVE-2020-1602 affects several versions of Junos OS, including 15.1, 16.1, and all the way to 19.2, specifically in configurations using the JDHCPD process.
Can CVE-2020-1602 lead to full system compromise?
Yes, CVE-2020-1602 potentially allows an attacker to execute arbitrary code, which could lead to full system compromise depending on the network environment.
Is there a workaround for CVE-2020-1602 before patching?
While the primary recommendation is to apply the patch, temporarily disabling DHCP relay configurations could help mitigate the risk associated with CVE-2020-1602.