CVE-2024-21607: Junos OS: MX Series and EX9200 Series: If the "tcp-reset" option used in an IPv6 filter, matched packets are accepted instead of rejected
An Unsupported Feature in the UI vulnerability in Juniper Networks Junos OS on MX Series and EX9200 Series allows an unauthenticated, network-based attacker to cause partial impact to the integrity of the device.
If the "tcp-reset" option is added to the "reject" action in an IPv6 filter which matches on "payload-protocol", packets are permitted instead of rejected. This happens because the payload-protocol match criteria is not supported in the kernel filter causing it to accept all packets without taking any other action. As a fix the payload-protocol match will be treated the same as a "next-header" match to avoid this filter bypass.
This issue doesn't affect IPv4 firewall filters.
This issue affects Juniper Networks Junos OS on MX Series and EX9200 Series:
All versions earlier than 20.4R3-S7; 21.1 versions earlier than 21.1R3-S5; 21.2 versions earlier than 21.2R3-S5; 21.3 versions earlier than 21.3R3-S4; 21.4 versions earlier than 21.4R3-S4; 22.1 versions earlier than 22.1R3-S2; 22.2 versions earlier than 22.2R3-S2; 22.3 versions earlier than 22.3R2-S2, 22.3R3; 22.4 versions earlier than 22.4R1-S2, 22.4R2-S2, 22.4R3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Networks Junos OS (MX Series and EX9200 Series)to a version that resolves this vulnerability.Fixed in 20.4R3-S7 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series and EX9200 Series)to a version that resolves this vulnerability.Fixed in 21.1R3-S5 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series and EX9200 Series)to a version that resolves this vulnerability.Fixed in 21.2R3-S5 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series and EX9200 Series)to a version that resolves this vulnerability.Fixed in 21.3R3-S4 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series and EX9200 Series)to a version that resolves this vulnerability.Fixed in 21.4R3-S4 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series and EX9200 Series)to a version that resolves this vulnerability.Fixed in 22.1R3-S2 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series and EX9200 Series)to a version that resolves this vulnerability.Fixed in 22.2R3-S2 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series and EX9200 Series)to a version that resolves this vulnerability.Fixed in 22.3R2-S2 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series and EX9200 Series)to a version that resolves this vulnerability.Fixed in 22.3R3 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series and EX9200 Series)to a version that resolves this vulnerability.Fixed in 22.4R1-S2 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series and EX9200 Series)to a version that resolves this vulnerability.Fixed in 22.4R2-S2 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series and EX9200 Series)to a version that resolves this vulnerability.Fixed in 22.4R3 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series and EX9200 Series)to a version that resolves this vulnerability.Fixed in 23.2R1 - Configuration
On MX Series and EX9200 Series, apply the Junos OS fix so the "payload-protocol" match is handled the same as a "next-header" match to avoid filter bypass.
Juniper Networks Junos OS IPv6 firewall filters payload-protocol match handling = Treat payload-protocol match the same as a "next-header" match - Configuration
If you have an IPv6 filter that matches on "payload-protocol", ensure the "tcp-reset" option is NOT added to the "reject" action; otherwise matched packets are permitted instead of rejected.
Juniper Networks Junos OS IPv6 firewall filters tcp-reset option in reject action for payload-protocol match = Do not add tcp-reset to the reject action when using an IPv6 filter that matches on payload-protocol - Compensating control
Use IPv4 firewall filters for filtering where applicable, since this issue does not affect IPv4 firewall filters (payload-protocol match problem is described for IPv6 filters).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21607?
CVE-2024-21607 has a severity rating according to the CVSS v4.0 standards.
How do I fix CVE-2024-21607?
To fix CVE-2024-21607, update your Junos OS to a patched version as recommended by Juniper Networks.
Which versions of Junos OS are affected by CVE-2024-21607?
CVE-2024-21607 affects multiple versions of Junos OS including versions below 20.4 and specific releases of 20.4 up to 22.4.
Can CVE-2024-21607 be exploited remotely?
Yes, CVE-2024-21607 can be exploited by unauthenticated, network-based attackers.
What impact does CVE-2024-21607 have on the device?
CVE-2024-21607 may cause partial impact to the integrity of the affected device.