CVE-2020-1633: Junos OS: MX Series: Crafted packets traversing a Broadband Network Gateway (BNG) configured with IPv6 NDP proxy could lead to Denial of Service
Due to a new NDP proxy feature for EVPN leaf nodes introduced in Junos OS 17.4, crafted NDPv6 packets could transit a Junos device configured as a Broadband Network Gateway (BNG) and reach the EVPN leaf node, causing a stale MAC address entry. This could cause legitimate traffic to be discarded, leading to a Denial of Service (DoS) condition. This issue only affects Junos OS 17.4 and later releases. Prior releases do not support this feature and are unaffected by this vulnerability. This issue only affects IPv6. IPv4 ARP proxy is unaffected by this vulnerability. This issue affects Juniper Networks Junos OS: 17.4 versions prior to 17.4R2-S9, 17.4R3 on MX Series; 18.1 versions prior to 18.1R3-S9 on MX Series; 18.2 versions prior to 18.2R2-S7, 18.2R3-S3 on MX Series; 18.2X75 versions prior to 18.2X75-D33, 18.2X75-D411, 18.2X75-D420, 18.2X75-D60 on MX Series; 18.3 versions prior to 18.3R1-S7, 18.3R2-S3, 18.3R3 on MX Series; 18.4 versions prior to 18.4R1-S5, 18.4R2-S2, 18.4R3 on MX Series; 19.1 versions prior to 19.1R1-S4, 19.1R2 on MX Series; 19.2 versions prior to 19.2R1-S3, 19.2R2 on MX Series.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 17.4R2-S9 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 17.4R3 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 18.1R3-S9 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 18.2R2-S7 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 18.2R3-S3 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 18.2X75-D33 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 18.2X75-D411 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 18.2X75-D420 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 18.2X75-D60 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 18.3R1-S7 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 18.3R2-S3 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 18.3R3 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 18.3R3-S1 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 18.4R1-S5 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 18.4R2-S2 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 18.4R3 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 19.1R1-S4 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 19.1R2 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 19.2R1-S3 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 19.2R2 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 19.3R1 - Upgrade
Upgrade
Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 19.4R1
Event History
Frequently Asked Questions
What is the severity of CVE-2020-1633?
The severity of CVE-2020-1633 is considered high due to the potential for legitimate traffic impact.
How do I fix CVE-2020-1633?
To fix CVE-2020-1633, you should update to the latest version of Junos OS that addresses this vulnerability.
Which versions of Junos OS are affected by CVE-2020-1633?
Junos OS versions 17.4, 18.1, 18.2, 18.3, 18.4, and 19.1 are affected by CVE-2020-1633.
What type of attack does CVE-2020-1633 involve?
CVE-2020-1633 involves an exploitation of crafted Neighbor Discovery Protocol for IPv6 (NDPv6) packets.
What can happen if CVE-2020-1633 is exploited?
Exploitation of CVE-2020-1633 can lead to stale MAC address entries, causing disruptions in network traffic.