CVE-2024-39553: Junos OS Evolved: Receipt of arbitrary data when sampling service is enabled, leads to partial Denial of Service (DoS).
First published: Thu Jul 11 2024(Updated: )
An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to send arbitrary data to the device, which leads msvcsd process to crash with limited availability impacting Denial of Service (DoS) and allows unauthorized network access to the device, potentially impacting system integrity. This issue only happens when inline jflow is configured. This does not impact any forwarding traffic. The impacted services MSVCS-DB app crashes momentarily and recovers by itself. This issue affects Juniper Networks Junos OS Evolved: * 21.4 versions earlier than 21.4R3-S7-EVO; * 22.2 versions earlier than 22.2R3-S3-EVO; * 22.3 versions earlier than 22.3R3-S2-EVO; * 22.4 versions earlier than 22.4R3-EVO; * 23.2 versions earlier than 23.2R1-S2-EVO, 23.2R2-EVO.
Credit: sirt@juniper.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Juniper Networks Junos OS | <21.4R3-S7-EVO<22.2R3-S3-EVO<22.3R3-S2-EVO<22.4R3-EVO<23.2R1-S2-EVO<23.2R2-EVO |
Remedy
The following software releases have been updated to resolve this specific issue: Junos OS Evolved: 21.4R3-S7-EVO, 22.2R3-S3-EVO, 22.3R3-S2-EVO, 22.4R3-EVO, 23.2R1-S2-EVO, 23.2R2-EVO, 23.4R1-EVO, and all subsequent releases.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-39553?
CVE-2024-39553 is classified as a high severity vulnerability due to its potential to cause service crashes.
How do I fix CVE-2024-39553?
To fix CVE-2024-39553, upgrade Junos OS Evolved to a version above 22.4R3-EVO or 23.2R2-EVO.
Which versions of Junos OS Evolved are affected by CVE-2024-39553?
Affected versions include 21.4R3-S7-EVO, 22.2R3-S3-EVO, 22.3R3-S2-EVO, 22.4R3-EVO, 23.2R1-S2-EVO, and 23.2R2-EVO.
Can CVE-2024-39553 be exploited remotely?
Yes, CVE-2024-39553 can be exploited remotely by unauthenticated attackers.
What impact does CVE-2024-39553 have on devices?
CVE-2024-39553 can cause the msvcsd process to crash, which may lead to limited availability and potential denial of service.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/juniper networks
- canonical/juniper networks junos os