CVE-2024-47504: Junos OS: SRX5000 Series: Receipt of a specific malformed packet will cause a flowd crash
First published: Fri Oct 11 2024(Updated: )
An Improper Validation of Specified Type of Input vulnerability in the packet forwarding engine (pfe) Juniper Networks Junos OS on SRX5000 Series allows an unauthenticated, network based attacker to cause a Denial of Service (Dos). When a non-clustered SRX5000 device receives a specifically malformed packet this will cause a flowd crash and restart. This issue affects Junos OS: * 22.1 releases 22.1R1 and later before 22.2R3-S5, * 22.3 releases before 22.3R3-S4, * 22.4 releases before 22.4R3-S4, * 23.2 releases before 23.2R2-S2, * 23.4 releases before 23.4R2-S1, * 24.2 releases before 24.2R1-S1, 24.2R2. Please note that the PR does indicate that earlier versions have been fixed as well, but these won't be adversely impacted by this.
Credit: sirt@juniper.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Juniper Junos | >=22.1R1<22.2R3-S5<22.3R3-S4<22.4R3-S4<23.2R2-S2<23.4R2-S1<24.2R1-S1 |
Remedy
The following software releases have been updated to resolve this specific issue: 22.2R3-S5*, 22.3R3-S4*, 22.4R3-S4, 23.2R2-S2, 23.4R2-S1, 24.2R1-S1, 24.2R2*, 24.4R1*, and all subsequent releases. (* future release)
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-47504?
CVE-2024-47504 is classified as a high severity vulnerability due to its potential to cause a Denial of Service (DoS) attack.
How do I fix CVE-2024-47504?
To fix CVE-2024-47504, upgrade your Junos OS to a version that is not affected, specifically newer than the specified vulnerable versions.
Which devices are affected by CVE-2024-47504?
CVE-2024-47504 affects the Juniper Networks SRX5000 Series devices running specific versions of Junos OS.
Can CVE-2024-47504 be exploited remotely?
Yes, an unauthenticated, network-based attacker can exploit CVE-2024-47504 remotely.
What type of vulnerability is CVE-2024-47504?
CVE-2024-47504 is an Improper Validation of Specified Type of Input vulnerability.
- agent/remedy
- agent/weakness
- agent/references
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/juniper networks
- canonical/juniper junos