A Missing Authentication for Critical Function vulnerability in the Flexible PIC Concentrators (FPCs) of Juniper Networks Junos OS Evolved on PTX Series allows a local, authenticated attacker with low privileges to gain direct access to FPCs installed in the device.

A local user with low privileges can gain direct access to the installed FPCs as a high privileged user, which can potentially lead to a full compromise of the affected component.

This issue affects Junos OS Evolved on PTX10004, PTX10008, PTX100016, with JNP10K-LC1201 or JNP10K-LC1202:

All versions before 21.2R3-S8-EVO, 21.4-EVO versions before 21.4R3-S7-EVO, 22.2-EVO versions before 22.2R3-S4-EVO, 22.3-EVO versions before 22.3R3-S3-EVO, 22.4-EVO versions before 22.4R3-S2-EVO, 23.2-EVO versions before 23.2R2-EVO.

An Incorrect Calculation vulnerability in the Layer 2 Control

Protocol

Daemon (l2cpd) of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent attacker flapping the management interface to cause the learning of new MACs over label-switched interfaces (LSI) to stop while generating a flood of logs, resulting in high CPU usage.

When the issue is seen, the following log message will be generated:

op:1 flag:0x6 mac:xx:xx:xx:xx:xx:xx bd:2 ifl:13302 reason:0(REASONNONE) i-op:6(INTRNLOPHWFORCEDELETE) status:10 lstatus:10 err:26(GETIFBDVALIDATEFAILED) err-reason 4(IFBDVALIDATEFAILEPOCHMISMATCH) hwwr:0x4 ctxsync:0 fwdsync:0 rtt-id:51 pifl:0 fwdnh:0 svlbnh:0 event:- smask:0x100000000 dmask:0x0 mplsmask 0x1 act:0x5800 extf:0x0 pfe-id 0 hw-notif-ifl 13302 programmed-ifl 4294967295 pseudo-vtep underlay-ifl-idx 0 stack:GETMAC, ALLOCATEMAC, GETIFL, GETIFF, GETIFBD, STOP,

This issue affects Junos OS Evolved:

all versions before 21.4R3-S7-EVO,  from 22.2 before 22.2R3-S4-EVO,  from 22.3 before 22.3R3-S3-EVO,  from 22.4 before 22.4R3-S2-EVO,  from 23.2 before 23.2R2-S1-EVO,  from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Juniper DHCP service (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allows a DHCP client in one subnet to exhaust the address pools of other subnets, leading to a Denial of Service (DoS) on the downstream DHCP server.

By default, the DHCP relay agent inserts its own Option 82 information when forwarding client requests, optionally replacing any Option 82 information provided by the client. When a specific DHCP DISCOVER is received in 'forward-only' mode with Option 82, the device should drop the message unless 'trust-option82' is configured. Instead, the DHCP relay forwards these packets to the DHCP server unmodified, which uses up addresses in the DHCP server's address pool, ultimately leading to address pool exhaustion.

This issue affects Junos OS:

all versions before 21.2R3-S10, from 21.4 before 21.4R3-S12, all versions of 22.2, from 22.4 before 22.4R3-S8,  from 23.2 before 23.2R2-S5,  from 23.4 before 23.4R2-S6,  from 24.2 before 24.2R2-S2,  from 24.4 before 24.4R2,  from 25.2 before 25.2R1-S1, 25.2R2.

Junos OS Evolved:

all versions before 21.4R3-S12-EVO,  all versions of 22.2-EVO, from 22.4 before 22.4R3-S8-EVO,  from 23.2 before 23.2R2-S5-EVO,  from 23.4 before 23.4R2-S6-EVO,  from 24.2 before 24.2R2-S2-EVO,  from 24.4 before 24.4R2-EVO,  from 25.2 before 25.2R1-S1-EVO, 25.2R2-EVO.

A Reachable Assertion vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).

When the device receives a specific BGP UPDATE packet, the rpd crashes and restarts. Continuous receipt of this specific packet will cause a sustained DoS condition.

For the issue to occur, BGP multipath with "pause-computation-during-churn" must be configured on the device, and the attacker must send the paths via a BGP UPDATE from a established BGP peer.

This issue affects: Junos OS: All versions before 21.4R3-S7, from 22.3 before 22.3R3-S3, from 22.4 before 22.4R3-S5, from 23.2 before 23.2R2, from 23.4 before 23.4R2.

Junos OS Evolved: All versions before 21.4R3-S7-EVO, from 22.3 before 22.3R3-S3-EVO, from 22.4 before 22.4R3-S5-EVO, from 23.2 before 23.2R2-EVO, from 23.4 before 23.4R2-EVO.

An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a memory corruption that leads to a rpd crash.

When the logical interface using a routing instance flaps continuously, specific updates are sent to the jflow/sflow modules. This results in memory corruption, leading to an rpd crash and restart.

Continued receipt of these specific updates will cause a sustained Denial of Service condition.

This issue affects Junos OS:

All versions before 21.2R3-S9, All versions of 21.4, All versions of 22.2, from 22.4 before 22.4R3-S7, from 23.2 before 23.2R2-S3, from 23.4 before 23.4R2-S4, from 24.2 before 24.2R2.

Junos OS Evolved:

All versions of 21.2-EVO,  All versions of 21.4-EVO,  All versions of 22.2-EVO,  from 22.4 before 22.4R3-S7-EVO,  from 23.2 before 23.2R2-S3-EVO,  from 23.4 before 23.4R2-S4-EVO,  from 24.2 before 24.2R2-EVO.

A Buffer Access with Incorrect Length Value vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When an attacker sends a specific ICMPv6 packet to an interface with "protocols router-advertisement" configured, rpd crashes and restarts. Continued receipt of this packet will cause a sustained DoS condition.

This issue only affects systems configured with IPv6.

This issue affects Junos OS:

All versions before 21.2R3-S9,  from 21.4 before 21.4R3-S10, from 22.2 before 22.2R3-S6, from 22.4 before 22.4R3-S4, from 23.2 before 23.2R2-S2, from 23.4 before 23.4R2;

and Junos OS Evolved: All versions before 21.2R3-S9-EVO, from 21.4-EVO before 21.4R3-S10-EVO, from 22.2-EVO before 22.2R3-S6-EVO, from 22.4-EVO before 22.4R3-S4-EVO, from 23.2-EVO before 23.2R2-S2-EVO, from 23.4-EVO before 23.4R2-EVO.

A Signed to Unsigned Conversion Error vulnerability in the Layer 2 Control Protocol daemon (l2cpd) of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated adjacent attacker sending a specifically malformed LLDP TLV to cause the l2cpd process to crash and restart, causing a Denial of Service (DoS).  Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

When an LLDP telemetry subscription is active, receipt of a specifically malformed LLDP TLV causes the l2cpd process to crash and restart.

This issue affects:

Junos OS:

All versions before 21.2R3-S9,  from 21.4 before 21.4R3-S10,  from 22.2 before 22.2R3-S6,  from 22.4 before 22.4R3-S6,  from 23.2 before 23.2R2-S3,  from 23.4 before 23.4R2-S4,  from 24.2 before 24.2R2;

Junos OS Evolved:

All versions before 21.4R3-S10-EVO, from 22.2-EVO before 22.2R3-S6-EVO,  from 22.4-EVO before 22.4R3-S6-EVO,  from 23.2-EVO before 23.2R2-S3-EVO,  from 23.4-EVO before 23.4R2-S4-EVO,  from 24.2-EVO before 24.2R2-EVO.

A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause an FPC to crash, leading to Denial of Service (DoS).

On all Junos OS and Junos OS Evolved platforms, in an EVPN-VXLAN scenario, when specific ARP packets are received on an IPv4 network, or specific NDP packets are received on an IPv6 network, kernel heap memory leaks, which eventually leads to an FPC crash and restart.

This issue does not affect MX Series platforms. Heap size growth on FPC can be seen using below command.

user@host> show chassis fpc                     Temp CPU Utilization (%) CPU Utilization (%) Memory   Utilization (%) Slot State           (C) Total Interrupt     1min   5min   15min   DRAM (MB)   Heap   Buffer   0 Online           45     3         0       2       2      2       32768      19       0 <<<<<<< Heap increase in all fPCs

This issue affects Junos OS:

All versions before 21.2R3-S7, 21.4 versions before 21.4R3-S4, 22.2 versions before 22.2R3-S1,  22.3 versions before 22.3R3-S1,  22.4 versions before 22.4R2-S2, 22.4R3.

and Junos OS Evolved:

All versions before 21.2R3-S7-EVO, 21.4-EVO versions before 21.4R3-S4-EVO, 22.2-EVO versions before 22.2R3-S1-EVO,  22.3-EVO versions before 22.3R3-S1-EVO,

22.4-EVO versions before 22.4R3-EVO.

This is a similar, but different vulnerability than the issue reported as CVE-2024-39549.

A double-free vulnerability in the routing process daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to send a malformed BGP Path attribute update which allocates memory used to log the bad path attribute. This double free of memory is causing an rpd crash, leading to a Denial of Service (DoS).

This issue affects:

Junos OS:  from 22.4 before 22.4R3-S4.

Junos OS Evolved: from 22.4 before 22.4R3-S4-EVO.

An Out-of-Bounds Read vulnerability in

the routing protocol daemon (rpd) of

Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue only affects systems configured in either of two ways:

systems with BGP traceoptions enabled

systems with BGP family traffic-engineering (BGP-LS) configured

and can be exploited from a directly connected and configured BGP peer.

This issue affects iBGP and eBGP

with

any address family

configured, and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects:

Junos OS:

from 21.4 before 21.4R3-S9,  from 22.2 before 22.2R3-S5,  from 22.3 before 22.3R3-S4,  from 22.4 before 22.4R3-S5,  from 23.2 before 23.2R2-S3,  from 23.4 before 23.4R2-S3,  from 24.2 before 24.2R1-S2, 24.2R2;

Junos OS Evolved:

from 21.4-EVO before 21.4R3-S9-EVO,  from 22.2-EVO before 22.2R3-S5-EVO,  from 22.3-EVO before 22.3R3-S4-EVO,  from 22.4-EVO before 22.4R3-S5-EVO,  from 23.2-EVO before 23.2R2-S3-EVO,  from 23.4-EVO before 23.4R2-S2-EVO,  from 24.2-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.

This issue does not affect versions of Junos OS prior to 21.3R1.

This issue does not affect versions of Junos OS Evolved prior to 21.3R1-EVO.

This is a similar, but different vulnerability than the issue reported as CVE-2024-39516.

An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker sending a specific BGP update packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS).

Continuous receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects Junos OS:

from 21.4 before 21.4R3-S9,  from 22.2 before 22.2R3-S5,  from 22.3 before 22.3R3-S4, from 22.4 before 22.4R3-S5,  from 23.2 before 23.2R2-S3,  from 23.4 before 23.4R2-S3,  from 24.2 before 24.2R1-S2, 24.2R2;

This issue does not affect versions prior to 21.1R1.

Junos OS Evolved:

from 21.4 before 21.4R3-S9-EVO,  from 22.2 before 22.2R3-S5-EVO,  from 22.3 before 22.3R3-S4-EVO, from 22.4 before 22.4R3-S5-EVO,  from 23.2 before 23.2R2-S3-EVO,  from 23.4 before 23.4R2-S3-EVO,  from 24.2 before 24.2R1-S2-EVO, 24.2R2-EVO.

This issue does not affect versions prior to 21.1R1-EVO

An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a Denial-of-Service (DoS).

On devices with SRv6 (Segment Routing over IPv6) enabled, an attacker can send a malformed BGP UPDATE packet which will cause the rpd to crash and restart. Continued receipt of these UPDATE packets will cause a sustained DoS condition.

This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.This issue affects Junos OS:

All versions before 21.2R3-S9,  from 21.4 before 21.4R3-S10,  from 22.2 before 22.2R3-S5,  from 22.3 before 22.3R3-S4,  from 22.4 before 22.4R3-S3,  from 23.2 before 23.2R2-S2,  from 23.4 before 23.4R2;

and Junos OS Evolved:

All versions before 21.2R3-S9-EVO,  from 21.4-EVO before 21.4R3-S10-EVO,  from 22.2-EVO before 22.2R3-S5-EVO,  from 22.3-EVO before 22.3R3-S4-EVO,  from 22.4-EVO before 22.4R3-S3-EVO, from 23.2-EVO before 23.2R2-S2-EVO,  from 23.4-EVO before 23.4R2-EVO.

An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an authenticated, network-based attacker to cause an FPC crash leading to a Denial of Service (DoS).When specific SNMP GET operations or specific low-priviledged CLI commands are executed, a GUID resource leak will occur, eventually leading to exhaustion and resulting in FPCs to hang. Affected FPCs need to be manually restarted to recover.

GUID exhaustion will trigger a syslog message like one of the following:

evo-pfemand[<pid>]: getnextguid: Ran out of Guid Space ... evo-aftmand-zx[<pid>]: getnextguid: Ran out of Guid Space ... The leak can be monitored by running the following command and taking note of the values in the rightmost column labeled Guids:

user@host> show platform application-info allocations app evo-pfemand/evo-pfemand

In case one or more of these values are constantly increasing the leak is happening.

This issue affects Junos OS Evolved:

All versions before 21.4R2-EVO, 22.1 versions before 22.1R2-EVO.

Please note that this issue is similar to, but different from CVE-2024-47505 and CVE-2024-47508.

An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an authenticated, network-based attacker to cause an FPC crash leading to a Denial of Service (DoS).When specific SNMP GET operations or specific low-priviledged CLI commands are executed, a GUID resource leak will occur, eventually leading to exhaustion and resulting in FPCs to hang. Affected FPCs need to be manually restarted to recover.

GUID exhaustion will trigger a syslog message like one of the following:

evo-pfemand[<pid>]: getnextguid: Ran out of Guid Space ... evo-aftmand-zx[<pid>]: getnextguid: Ran out of Guid Space ... The leak can be monitored by running the following command and taking note of the values in the rightmost column labeled Guids:

user@host> show platform application-info allocations app evo-pfemand/evo-pfemand

In case one or more of these values are constantly increasing the leak is happening.

This issue affects Junos OS Evolved:

All versions before 21.2R3-S8-EVO, 21.3 versions before 21.3R3-EVO; 21.4 versions before 22.1R2-EVO,

22.1 versions before 22.1R1-S1-EVO, 22.1R2-EVO.

Please note that this issue is similar to, but different from CVE-2024-47505 and CVE-2024-47509.

An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved allows an authenticated, network-based attacker to cause an FPC crash leading to a Denial of Service (DoS).When specific SNMP GET operations or specific low-priviledged CLI commands are executed, a GUID resource leak will occur, eventually leading to exhaustion and resulting in FPCs to hang. Affected FPCs need to be manually restarted to recover.

GUID exhaustion will trigger a syslog message like one of the following:

evo-pfemand[<pid>]: getnextguid: Ran out of Guid Space ... evo-aftmand-zx[<pid>]: getnextguid: Ran out of Guid Space ... The leak can be monitored by running the following command and taking note of the values in the rightmost column labeled Guids:

user@host> show platform application-info allocations app evo-pfemand/evo-pfemand

In case one or more of these values are constantly increasing the leak is happening.

This issue affects Junos OS Evolved:

All versions before 21.4R3-S7-EVO, 22.1 versions before 22.1R3-S6-EVO, 22.2 versions before 22.2R3-EVO,

22.3 versions before 22.3R3-EVO, 22.4 versions before 22.4R2-EVO.

Please note that this issue is similar to, but different from CVE-2024-47508 and CVE-2024-47509.

An Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS).

In specific cases the state of TCP sessions that are terminated is not cleared, which over time leads to an exhaustion of resources, preventing new connections to the control plane from being established.

A continuously increasing number of connections shown by:

user@host > show system connections

is indicative of the problem. To recover the respective RE needs to be restarted manually.

This issue only affects IPv4 but does not affect IPv6. This issue only affects TCP sessions established in-band (over an interface on an FPC) but not out-of-band (over the management ethernet port on the routing-engine).

This issue affects Junos OS Evolved:

All versions before 21.4R3-S9-EVO, 22.2 versions before 22.2R3-S4-EVO, 22.4 version before 22.4R3-S3-EVO, 23.2 versions before 23.2R2-S1-EVO, 23.4 versions before 23.4R2-EVO.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS).

In a scenario where BGP Monitoring Protocol (BMP) is configured with rib-in pre-policy monitoring, receiving a BGP update with a specifically malformed AS PATH attribute over an established BGP session, can cause an RPD crash and restart.

This issue affects:

Junos OS:

All versions before 21.2R3-S8, 21.4 versions before 21.4R3-S8, 22.2 versions before 22.2R3-S4, 22.3 versions before 22.3R3-S3, 22.4 versions before 22.4R3-S2, 23.2 versions before 23.2R2-S1, 23.4 versions before 23.4R1-S2, 23.4R2;

Junos OS Evolved:

All versions before 21.2R3-S8-EVO, 21.4 versions before 21.4R3-S8-EVO, 22.2 versions before 22.2R3-S4-EVO, 22.3 versions before 22.3R3-S3-EVO, 22.4 versions before 22.4R3-S2-EVO, 23.2 versions before 23.2R2-S1-EVO, 23.4 versions before 23.4R1-S2-EVO, 23.4R2-EVO.

An Unimplemented or Unsupported Feature in UI vulnerability in the CLI of Juniper Networks Junos OS Evolved on QFX5000 Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).

Several configuration statements meant to enforce limits on MAC learning and moves can be configured but do not take effect. This can lead to control plane overload situations which will severely impact the ability of the device to processes legitimate traffic.

This issue affects Junos OS Evolved on QFX5000 Series:

All versions before 21.4R3-S8-EVO, 22.2-EVO versions before 22.2R3-S5-EVO,

22.4-EVO versions before 22.4R3-EVO, 23.2-EVO versions before 23.2R2-EVO.

An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of the device when Dual Routing Engines (REs) are in use on Juniper Networks Junos OS Evolved devices.

This issue affects: Juniper Networks Junos OS Evolved with dual-REs: All versions before 21.2R3-S8-EVO, from 21.4-EVO before 21.4R3-S8-EVO, from 22.2-EVO before 22.2R3-S4-EVO, from 22.3-EVO before 22.3R3-S4-EVO, from 22.4-EVO before 22.4R3-S3-EVO, from 23.2-EVO before 23.2R2-S1-EVO, from 23.4-EVO before 23.4R2-S1-EVO.

This issue does not affect Juniper Networks Junos OS.

An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based, unauthenticated attacker to cause Denial of Service (DoS).

When a BGP UPDATE with malformed path attribute is received over an established BGP session, rpd crashes and restarts.

Continuous receipt of a BGP UPDATE with a specifically malformed path attribute will create a sustained Denial of Service (DoS) condition for impacted devices. While this issue affects systems running 32-bit and 64-bit systems, the probability of impact on 64-bit system is extremely low.  According to KB25803 https://supportportal.juniper.net/s/article/Junos-How-to-check-if-Junos-OS-is-64-or-32-bit-on-a-router , customers can confirm 32-bit or 64-bit system via the ' show version detail ' command:

lab@router> show version detail| match 32      JUNOS 32-bit kernel Software Suite

lab@router> show version detail| match 64      JUNOS 64-bit kernel Software Suite

This issue affects:

Juniper Networks Junos OS:

All versions before 21.4R3-S8,  from 22.2 before 22.2R3-S4,  from 22.4 before 22.4R3-S3,  from 23.2 before 23.2R2-S1,  from 23.4 before 23.4R1-S2, 23.4R2.

Juniper Networks Junos OS Evolved:  All versions before 21.4R3-S8-EVO, from 22.2 before 22.2R3-S4-EVO, from 22.4 before 22.4R3-S3-EVO, from 23.2 before 23.2R2-S1-EVO, from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO.

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX 7000 Series allows an unauthenticated, network based attacker to cause increased consumption of resources, ultimately resulting in a Denial of Service (DoS).

When specific transit MPLS packets are received by the PFE, these packets are internally forwarded to the Routing Engine (RE), rather than being handled appropriately. Continuous receipt of these MPLS packets causes resources to be exhausted. MPLS config is not required to be affected by this issue.

This issue affects Junos OS Evolved ACX 7000 Series:

All versions before 21.4R3-S9-EVO, 22.2-EVO before 22.2R3-S4-EVO,  22.3-EVO before 22.3R3-S3-EVO,  22.4-EVO before 22.4R3-S2-EVO,  23.2-EVO before 23.2R2-EVO,  23.4-EVO before 23.4R1-S1-EVO, 23.4R2-EVO.

An Improper Handling of Exceptional Conditions vulnerability in the rpd-server of Juniper Networks Junos OS and Junos OS Evolved within cRPD allows an unauthenticated network-based attacker sending crafted TCP traffic to the routing engine (RE) to cause a CPU-based Denial of Service (DoS).

If specially crafted TCP traffic is received by the control plane, or a TCP session terminates unexpectedly, it will cause increased control plane CPU utilization by the rpd-server process.

While not explicitly required, the impact is more severe when RIB sharding is enabled.

Task accounting shows unexpected reads by the RPD Server jobs for shards:

user@junos> show task accounting detail ... read:RPD Server.0.0.0.0+780.192.168.0.78+48886 TOT:00000003.00379787 MAX:00000000.00080516 RUNS: 233888\ read:RPD Server.0.0.0.0+780.192.168.0.78+49144 TOT:00000004.00007565 MAX:00000000.00080360 RUNS: 233888\ read:RPD Server.0.0.0.0+780.192.168.0.78+49694 TOT:00000003.00600584 MAX:00000000.00080463 RUNS: 233888\ read:RPD Server.0.0.0.0+780.192.168.0.78+50246 TOT:00000004.00346998 MAX:00000000.00080338 RUNS: 233888\

This issue affects:

Junos OS with cRPD:

All versions before 21.2R3-S8,  21.4 before 21.4R3-S7,  22.1 before 22.1R3-S6,  22.2 before 22.2R3-S4,  22.3 before 22.3R3-S3,  22.4 before 22.4R3-S2,  23.2 before 23.2R2-S2,  24.2 before 24.2R2;

Junos OS Evolved with cRPD:

All versions before 21.4R3-S7-EVO,  22.2 before 22.2R3-S4-EVO,  22.3 before 22.3R3-S3-EVO,  22.4 before 22.4R3-S2-EVO,  23.2 before 23.2R2-EVO.

An Improper Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS on MX Series with MPC10/MPC11/LC9600 line cards, EX9200 with EX9200-15C lines cards, MX304 devices, and Juniper Networks Junos OS Evolved on PTX Series, allows an attacker sending malformed DHCP packets to cause ingress packet processing to stop, leading to a Denial of Service (DoS).  Continued receipt and processing of these packets will create a sustained Denial of Service (DoS) condition.

This issue only occurs if DHCP snooping is enabled. See configuration below.

This issue can be detected using following commands. Their output will display the interface status going down:

user@device>show interfaces <if--x/x/x> user@device>show log messages | match <if--x/x/x> user@device>show log messages ==> will display the "[Error] Wedge-Detect : Host Loopback Wedge Detected: PFE: no," logs.

This issue affects: Junos OS on

MX Series

with MPC10/MPC11/LC9600 line cards, EX9200 with EX9200-15C line cards, and MX304:

All versions before 21.2R3-S7, from 21.4 before 21.4R3-S6, from 22.2 before 22.2R3-S3, all versions of 22.3, from 22.4 before 22.4R3, from 23.2 before 23.2R2;

Junos OS Evolved on PTX Series: from 19.3R1-EVO before 21.2R3-S8-EVO,

from 21.4-EVO before 21.4R3-S7-EVO, from 22.1-EVO before 22.1R3-S6-EVO, from 22.2-EVO before 22.2R3-S5-EVO, from 22.3-EVO before 22.3R3-S3-EVO, from 22.4-EVO before 22.4R3-S1-EVO, from 23.2-EVO before 23.2R2-S2-EVO, from 23.4-EVO before 23.4R2-EVO.

Junos OS Evolved releases prior to 19.3R1-EVO are unaffected by this vulnerability

An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specific BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue only affects systems with BGP traceoptions enabled and

requires a BGP session to be already established.  Systems without BGP traceoptions enabled are not affected by this issue.

This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects:

Junos OS:

All versions before 21.2R3-S8,  from 21.4 before 21.4R3-S8,  from 22.2 before 22.2R3-S4,  from 22.3 before 22.3R3-S4, from 22.4 before 22.4R3-S3,  from 23.2 before 23.2R2-S1,  from 23.4 before 23.4R2;

Junos OS Evolved:

All versions before 21.2R3-S8-EVO,  from 21.4-EVO before 21.4R3-S8-EVO,  from 22.2-EVO before 22.2R3-S4-EVO,  from 22.3-EVO before 22.3R3-S4-EVO, from 22.4-EVO before 22.4R3-S3-EVO,  from 23.2-EVO before 23.2R2-S1-EVO,  from 23.4-EVO before 23.4R2-EVO.

An Out-of-Bounds Read vulnerability in

the routing protocol daemon (rpd) of

Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue only affects systems configured in either of two ways:

systems with BGP traceoptions enabled

systems with BGP traffic engineering configured

This issue can affect iBGP and eBGP with

any address family

configured. The specific attribute involved is non-transitive, and will not propagate across a network.

This issue affects:

Junos OS:

All versions before 21.4R3-S8, 22.2 before 22.2R3-S5,  22.3 before 22.3R3-S4,  22.4 before 22.4R3-S3,  23.2 before 23.2R2-S2,  23.4 before 23.4R2;

Junos OS Evolved:

All versions before 21.4R3-S8-EVO,  22.2-EVO before 22.2R3-S5-EVO,  22.3-EVO before 22.3R3-S4-EVO,  22.4-EVO before 22.4R3-S3-EVO,  23.2-EVO before 23.2R2-S2-EVO,  23.4-EVO before 23.4R2-EVO.

An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

In some cases, rpd fails to restart requiring a manual restart via the 'restart routing' CLI command.

This issue only affects systems with BGP traceoptions enabled and

requires a BGP session to be already established. Systems without BGP traceoptions enabled are not affected by this issue.

This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects:

Junos OS:

All versions before 21.4R3-S8,  22.2 before 22.2R3-S5,  22.3 before 22.3R3-S4,  22.4 before 22.4R3-S3,  23.2 before 23.2R2-S2,  23.4 before 23.4R2;

Junos OS Evolved:

All versions before 21.4R3-S8-EVO,  22.2-EVO before 22.2R3-S5-EVO,  22.3-EVO before 22.3R3-S4-EVO,  22.4-EVO before 22.4R3-S3-EVO,  23.2-EVO before 23.2R2-S2-EVO,  23.4-EVO before 23.4R2-EVO.

An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a network based, unauthenticated attacker to cause the RPD process to crash leading to a Denial of Service (DoS).

When a malformed BGP UPDATE packet is received over an established BGP session, RPD crashes and restarts.

Continuous receipt of the malformed BGP UPDATE messages will create a sustained Denial of Service (DoS) condition for impacted devices.

This issue affects eBGP and iBGP, in both IPv4 and IPv6 implementations. This issue requires a remote attacker to have at least one established BGP session.

This issue affects: Juniper Networks Junos OS: All versions earlier than 20.4R3-S9; 21.2 versions earlier than 21.2R3-S7; 21.3 versions earlier than 21.3R3-S5; 21.4 versions earlier than 21.4R3-S6; 22.1 versions earlier than 22.1R3-S4; 22.2 versions earlier than 22.2R3-S3; 22.3 versions earlier than 22.3R3-S2; 22.4 versions earlier than 22.4R3; 23.2 versions earlier than 23.2R2.

Juniper Networks Junos OS Evolved: All versions earlier than 21.2R3-S7; 21.3-EVO versions earlier than 21.3R3-S5; 21.4-EVO versions earlier than 21.4R3-S8; 22.1-EVO versions earlier than 22.1R3-S4; 22.2-EVO versions earlier than 22.2R3-S3; 22.3-EVO versions earlier than 22.3R3-S2; 22.4-EVO versions earlier than 22.4R3; 23.2-EVO versions earlier than 23.2R2.

An Uncontrolled Resource Consumption vulnerability in the aftmand process of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to consume memory resources, resulting in a Denial of Service (DoS) condition. The processes do not recover on their own and must be manually restarted.

This issue affects both IPv4 and IPv6.

Changes in memory usage can be monitored using the following CLI command: user@device> show system memory node <fpc slot> | grep evo-aftmann This issue affects Junos OS Evolved:

All versions before 21.2R3-S8-EVO,  21.3 versions before 21.3R3-S5-EVO,  21.4 versions before 21.4R3-S5-EVO,  22.1 versions before 22.1R3-S4-EVO,  22.2 versions before 22.2R3-S4-EVO, 22.3 versions before 22.3R3-S3-EVO, 22.4 versions before 22.4R2-S2-EVO, 22.4R3-EVO,  23.2 versions before 23.2R1-S1-EVO, 23.2R2-EVO.

A Buffer Copy without Checking Size of Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated, adjacent attacker to send specific RPKI-RTR packets resulting in a crash, creating a Denial of Service (DoS) condition. Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue affects

Junos OS:

All versions before 21.2R3-S8,  from 21.4 before 21.4R3-S8, from 22.2 before 22.2R3-S4,  from 22.3 before 22.3R3-S3,  from 22.4 before 22.4R3-S2,  from 23.2 before 23.2R2-S1,  from 23.4 before 23.4R2.

Junos OS Evolved: All versions before 21.2R3-S8-EVO, from 21.4 before 21.4R3-S8-EVO, from 22.2 before 22.2R3-S4-EVO,  from 22.3 before 22.3R3-S3-EVO, from 22.4 before 22.4R3-S2-EVO,  from 23.2 before 23.2R2-S1-EVO, from 23.4 before 23.4R2-EVO.

A Buffer Copy without Checking Size of Input vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved on ACX7000 Series allows an unauthenticated, adjacent attacker to cause a

Denial-of-Service (DoS).When multicast traffic with a specific, valid (S,G) is received, evo-pfemand crashes which leads to an outage of the affected FPC until it is manually recovered.

This issue affects Junos OS Evolved on ACX7000 Series:

All versions before 21.2R3-S8-EVO, 21.4-EVO versions before 21.4R3-S7-EVO, 22.2-EVO versions before 22.2R3-S4-EVO, 22.3-EVO versions before 22.3R3-S3-EVO,  22.4-EVO versions before 22.4R3-S2-EVO,  23.2-EVO versions before 23.2R2-EVO,  23.4-EVO versions before 23.4R1-S2-EVO, 23.4R2-EVO.