CVE-2020-1661: Junos OS: jdhcpd process crash when forwarding a malformed DHCP packet.

Published Oct 16, 2020

Updated

On Juniper Networks Junos OS devices configured as a DHCP forwarder, the Juniper Networks Dynamic Host Configuration Protocol Daemon (jdhcp) process might crash when receiving a malformed DHCP packet. This issue only affects devices configured as DHCP forwarder with forward-only option, that forward specified DHCP client packets, without creating a new subscriber session. The jdhcpd daemon automatically restarts without intervention, but continuous receipt of the malformed DHCP packet will repeatedly crash jdhcpd, leading to an extended Denial of Service (DoS) condition. This issue can be triggered only by DHCPv4, it cannot be triggered by DHCPv6. This issue affects Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S16; 12.3X48 versions prior to 12.3X48-D105 on SRX Series; 14.1X53 versions prior to 14.1X53-D60 on EX and QFX Series; 15.1 versions prior to 15.1R7-S7; 15.1X49 versions prior to 15.1X49-D221, 15.1X49-D230 on SRX Series; 15.1X53 versions prior to 15.1X53-D593 on EX2300/EX3400; 16.1 versions prior to 16.1R7-S5.

Affected Software

235 affected components

Juniper Junos=12.3

Juniper Junos=12.3-r1

Juniper Junos=12.3-r10

Juniper Junos=12.3-r10-s1

Juniper Junos=12.3-r10-s2

Juniper Junos=12.3-r11

Juniper Junos=12.3-r12

Juniper Junos=12.3-r12-s1

Juniper Junos=12.3-r12-s11

Juniper Junos=12.3-r12-s12

Juniper Junos=12.3-r12-s13

Juniper Junos=12.3-r12-s14

Juniper Junos=12.3-r12-s15

Juniper Junos=12.3-r12-s3

Juniper Junos=12.3-r12-s4

Juniper Junos=12.3-r12-s6

Juniper Junos=12.3-r12-s8

Juniper Junos=12.3-r2

Juniper Junos=12.3-r3

Juniper Junos=12.3-r4

Juniper Junos=12.3-r5

Juniper Junos=12.3-r6

Juniper Junos=12.3-r7

Juniper Junos=12.3-r8

Juniper Junos=12.3-r9

Juniper Junos=15.1

Juniper Junos=15.1-a1

Juniper Junos=15.1-f

Juniper Junos=15.1-f1

Juniper Junos=15.1-f2

Juniper Junos=15.1-f2-s1

Juniper Junos=15.1-f2-s2

Juniper Junos=15.1-f2-s3

Juniper Junos=15.1-f2-s4

Juniper Junos=15.1-f3

Juniper Junos=15.1-f4

Juniper Junos=15.1-f5

Juniper Junos=15.1-f5-s7

Juniper Junos=15.1-f6

Juniper Junos=15.1-f6-s1

Juniper Junos=15.1-f6-s12

Juniper Junos=15.1-f6-s2

Juniper Junos=15.1-f6-s3

Juniper Junos=15.1-f6-s4

Juniper Junos=15.1-f6-s7

Juniper Junos=15.1-f7

Juniper Junos=15.1-r1

Juniper Junos=15.1-r2

Juniper Junos=15.1-r3

Juniper Junos=15.1-r4

Juniper Junos=15.1-r4-s7

Juniper Junos=15.1-r4-s8

Juniper Junos=15.1-r4-s9

Juniper Junos=15.1-r5

Juniper Junos=15.1-r5-s1

Juniper Junos=15.1-r5-s5

Juniper Junos=15.1-r5-s6

Juniper Junos=15.1-r6

Juniper Junos=15.1-r6-s1

Juniper Junos=15.1-r6-s2

Juniper Junos=15.1-r6-s6

Juniper Junos=15.1-r7

Juniper Junos=15.1-r7-s1

Juniper Junos=15.1-r7-s2

Juniper Junos=15.1-r7-s3

Juniper Junos=15.1-r7-s4

Juniper Junos=15.1-r7-s5

Juniper Junos=15.1-r7-s6

Juniper Junos=16.1

Juniper Junos=16.1-r1

Juniper Junos=16.1-r2

Juniper Junos=16.1-r3

Juniper Junos=16.1-r3-s10

Juniper Junos=16.1-r3-s11

Juniper Junos=16.1-r4

Juniper Junos=16.1-r4-s12

Juniper Junos=16.1-r4-s2

Juniper Junos=16.1-r4-s3

Juniper Junos=16.1-r4-s4

Juniper Junos=16.1-r4-s6

Juniper Junos=16.1-r5

Juniper Junos=16.1-r5-s4

Juniper Junos=16.1-r6-s1

Juniper Junos=16.1-r6-s6

Juniper Junos=16.1-r7

Juniper Junos=16.1-r7-s2

Juniper Junos=16.1-r7-s3

Juniper Junos=16.1-r7-s4

Juniper Junos=12.3x48

Juniper Junos=12.3x48-d10

Juniper Junos=12.3x48-d100

Juniper Junos=12.3x48-d15

Juniper Junos=12.3x48-d20

Juniper Junos=12.3x48-d25

Juniper Junos=12.3x48-d30

Juniper Junos=12.3x48-d35

Juniper Junos=12.3x48-d40

Juniper Junos=12.3x48-d45

Juniper Junos=12.3x48-d50

Juniper Junos=12.3x48-d51

Juniper Junos=12.3x48-d55

Juniper Junos=12.3x48-d60

Juniper Junos=12.3x48-d65

Juniper Junos=12.3x48-d70

Juniper Junos=12.3x48-d75

Juniper Junos=12.3x48-d80

Juniper Junos=12.3x48-d90

Juniper Junos=12.3x48-d95

Juniper Junos=15.1x49

Juniper Junos=15.1x49-d10

Juniper Junos=15.1x49-d100

Juniper Junos=15.1x49-d110

Juniper Junos=15.1x49-d120

Juniper Junos=15.1x49-d130

Juniper Junos=15.1x49-d140

Juniper Junos=15.1x49-d15

Juniper Junos=15.1x49-d150

Juniper Junos=15.1x49-d160

Juniper Junos=15.1x49-d170

Juniper Junos=15.1x49-d180

Juniper Junos=15.1x49-d190

Juniper Junos=15.1x49-d20

Juniper Junos=15.1x49-d200

Juniper Junos=15.1x49-d210

Juniper Junos=15.1x49-d25

Juniper Junos=15.1x49-d30

Juniper Junos=15.1x49-d35

Juniper Junos=15.1x49-d40

Juniper Junos=15.1x49-d45

Juniper Junos=15.1x49-d50

Juniper Junos=15.1x49-d55

Juniper Junos=15.1x49-d60

Juniper Junos=15.1x49-d65

Juniper Junos=15.1x49-d70

Juniper Junos=15.1x49-d75

Juniper Junos=15.1x49-d80

Juniper Junos=15.1x49-d90

Juniper SRX1500

Juniper SRX300

Juniper SRX320

Juniper SRX340

Juniper SRX345

Juniper Srx380

Juniper SRX4100

Juniper SRX4200

Juniper SRX4600

Juniper SRX5400

Juniper SRX550

Juniper SRX5600

Juniper SRX5800

Juniper Junos=15.1x53

Juniper Junos=15.1x53-d10

Juniper Junos=15.1x53-d20

Juniper Junos=15.1x53-d21

Juniper Junos=15.1x53-d210

Juniper Junos=15.1x53-d230

Juniper Junos=15.1x53-d231

Juniper Junos=15.1x53-d232

Juniper Junos=15.1x53-d233

Juniper Junos=15.1x53-d234

Juniper Junos=15.1x53-d235

Juniper Junos=15.1x53-d236

Juniper Junos=15.1x53-d237

Juniper Junos=15.1x53-d25

Juniper Junos=15.1x53-d30

Juniper Junos=15.1x53-d31

Juniper Junos=15.1x53-d32

Juniper Junos=15.1x53-d33

Juniper Junos=15.1x53-d34

Juniper Junos=15.1x53-d40

Juniper Junos=15.1x53-d45

Juniper Junos=15.1x53-d47

Juniper Junos=15.1x53-d470

Juniper Junos=15.1x53-d48

Juniper Junos=15.1x53-d495

Juniper Junos=15.1x53-d50

Juniper Junos=15.1x53-d51

Juniper Junos=15.1x53-d52

Juniper Junos=15.1x53-d55

Juniper Junos=15.1x53-d56

Juniper Junos=15.1x53-d57

Juniper Junos=15.1x53-d58

Juniper Junos=15.1x53-d59

Juniper Junos=15.1x53-d590

Juniper Junos=15.1x53-d591

Juniper Junos=15.1x53-d592

Juniper Junos=15.1x53-d60

Juniper Junos=15.1x53-d61

Juniper Junos=15.1x53-d62

Juniper Junos=15.1x53-d63

Juniper Junos=15.1x53-d64

Juniper Junos=15.1x53-d65

Juniper Junos=15.1x53-d66

Juniper Junos=15.1x53-d67

Juniper Junos=15.1x53-d68

Juniper Junos=15.1x53-d69

Juniper Junos=15.1x53-d70

Juniper EX2300

Juniper EX3400

Juniper Junos=14.1x53

Juniper Junos=14.1x53-d10

Juniper Junos=14.1x53-d15

Juniper Junos=14.1x53-d16

Juniper Junos=14.1x53-d25

Juniper Junos=14.1x53-d26

Juniper Junos=14.1x53-d27

Juniper Junos=14.1x53-d30

Juniper Junos=14.1x53-d34

Juniper Junos=14.1x53-d35

Juniper Junos=14.1x53-d40

Juniper Junos=14.1x53-d42

Juniper Junos=14.1x53-d43

Juniper Junos=14.1x53-d44

Juniper Junos=14.1x53-d45

Juniper Junos=14.1x53-d48

Juniper Junos=14.1x53-d50

Juniper Junos=14.1x53-d51

Juniper Junos=14.1x53-d52

Juniper Junos=14.1x53-d53

Juniper EX2300-C

Juniper EX4300

Juniper EX4600

Juniper EX4650

Juniper EX9200

Juniper Ex9250

Juniper QFX10002

Juniper QFX10008

Juniper QFX10016

Juniper QFX5100

Juniper QFX5110

Juniper QFX5120

Juniper Qfx5130

Juniper QFX5200

Juniper QFX5210

Juniper QFX5220

Remediation

Information

The following software releases have been updated to resolve this specific issue: Junos OS 12.3R12-S16, 12.3X48-D105, 15.1R7-S7, 15.1X49-D221, 15.1X49-D230, 15.1X53-D593, 16.1R7-S5, 16.2R1 and all subsequent releases.

Event History

Oct 16, 2020

CVE Published

via MITRE·08:31 PM

Data Sourced

via MITRE·08:31 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-1661?

CVE-2020-1661 is rated as high severity due to the potential for denial of service attacks when impacted devices receive malformed DHCP packets.

How do I fix CVE-2020-1661?

To address CVE-2020-1661, ensure that affected Juniper JUNOS OS software is updated to the latest version provided by Juniper Networks.

Which devices are affected by CVE-2020-1661?

CVE-2020-1661 affects Juniper Networks Junos OS devices configured as DHCP forwarders, specifically versions 12.3 and 15.1 among others.

What type of attack does CVE-2020-1661 enable?

CVE-2020-1661 could enable a denial of service attack resulting from the jdhcp process crashing upon receiving malformed DHCP requests.

When was CVE-2020-1661 disclosed?

CVE-2020-1661 was disclosed on June 29, 2020, highlighting its potential impact on network services.