A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privilged attacker to cause a Denial-of-Service (DoS).

On EX Series, QFX Series and MX Series a low-privileged attacker issuing a specific 'show l2-learning' or 'show ethernet-switching' command will cause an l2ald crash which will lead to a temporary service impact for all layer 2 services until the process has automatically restarted.

This issue affects EX Series, QFX Series, MX Series: Junos OS:

all versions before 23.2R2-S7, 23.4 versions before 23.4R2-S7, 24.2 versions before 24.2R2, 24.4 versions before 24.4R1-S2.

Junos OS Evolved: all versions before 23.2R2-S7-EVO, 23.4 versions before 23.4R2-S8-EVO, 24.2 versions before 24.2R2-EVO, 24.4 versions before 24.4R1-S3-EVO.

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact to the device.

Due to a wrong initialization, a process which should only be able to communicate internally within the device can be reached over the network via an open port. This leads to a device being inadvertently exposed and increased CPU cycles spent processing ingress packets.

This issue affects Junos OS Evolved:

all versions before 23.2R2-S7-EVO, 23.4 versions before 23.4R2-S8-EVO, 24.2 versions before 24.2R2-S5-EVO, 24.4 versions before 24.4R2-S4-EVO, 25.2 versions before 25.2R2-S1-EVO, 25.4 versions before 25.4R1-S2-EVO.

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a local user with low privileges to read sensitive information.

A local user with low privileges can execute the CLI command 'show mgd' with specific arguments which will expose sensitive information.

This issue affects

Junos OS: all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S6, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S4, 24.4 versions before 24.4R2-S1, 25.2 version before 25.2R1-S2, 25.2R2;

Junos OS Evolved: all versions before 23.2R2-S6-EVO, 23.4 version before 23.4R2-S6-EVO, 24.2 version before 24.2R2-S4-EVO, 24.4 versions before 24.4R2-S1-EVO, 25.2 versions before 25.2R2-EVO.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause an availability impact for downstream devices.

When an affected device receives a specific optional, transitive BGP attribute over an existing BGP session, it will be erroneously modified before propagation to peers. When the attribute is detected as malformed by the peers, these peers will most likely terminate the BGP sessions with the affected devices and thereby cause an availability impact due to the resulting routing churn.

This issue affects:

Junos OS:

all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S5 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S2, 24.4 versions before 24.4R2;

Junos OS Evolved:

all versions before 22.4R3-S8-EVO, 23.2 versions before 23.2R2-S5-EVO, 23.4 versions before 23.4R2-S6-EVO, 24.2 versions before 24.2R2-S2-EVO, 24.4 versions before 24.4R2-EVO.

An Incorrect Permission Assignment for Critical Resource vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged user to write to the Unix socket used to manage the jdhcpd process, resulting in complete control over the resource.

This vulnerability allows any low-privileged user logged into the system to connect to the Unix socket and issue commands to manage the DHCP service, in essence, taking administrative control of the local DHCP server or DHCP relay.

This issue affects: Junos OS: all versions before 21.2R3-S10, all versions of 22.2, from 21.4 before 21.4R3-S12, from 22.4 before 22.4R3-S8, from 23.2 before 23.2R2-S5, from 23.4 before 23.4R2-S6, from 24.2 before 24.2R2-S2, from 24.4 before 24.4R2, from 25.2 before 25.2R1-S1, 25.2R2;

Junos OS Evolved: all versions before 22.4R3-S8-EVO, from 23.2 before 23.2R2-S5-EVO, from 23.4 before 23.4R2-S6-EVO, from 24.2 before 24.2R2-S2-EVO, from 24.4 before 24.4R2-EVO, from 25.2 before 25.2R1-S1-EVO, 25.2R2-EVO.

An Untrusted Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with low privileges to cause a Denial-of-Service (DoS).

When the command 'show route < ( receive-protocol | advertising-protocol ) bgp > detail' is executed, and at least one of the routes in the intended output has specific attributes, this will cause an rpd crash and restart. 'show route ... extensive' is not affected.

This issue affects:

Junos OS:

all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S5, 23.4 versions before 23.4R2-S5, 24.2 versions before 24.2R2-S2, 24.4 versions before 24.4R2;

Junos OS Evolved:

all versions before 22.4R3-S8-EVO,  23.2 versions before 23.2R2-S5-EVO, 23.4 versions before 23.4R2-S6-EVO, 24.2 versions before 24.2R2-S2-EVO, 24.4 versions before 24.4R2-EVO.

A password aging vulnerability in the RADIUS client of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to access the device without enforcing the required password change.

Affected devices allow logins by users for whom the RADIUS server has responded with a reject and required the user to change the password as their password was expired. Therefore the policy mandating the password change is not enforced. This does not allow users to login with a wrong password, but only with the correct but expired one.

This issue affects:

Junos OS:

all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S4, 23.4 versions before 23.4R2-S5, 24.2 versions before 24.2R2-S1, 24.4 versions before 24.4R1-S3, 24.4R2;

Junos OS Evolved:

all versions before 22.4R3-S8-EVO, 23.2 versions before 23.2R2-S4-EVO, 23.4 versions before 23.4R2-S5-EVO, 24.2 versions before 24.2R2-S1-EVO, 24.4 versions before 24.4R1-S3-EVO, 24.4R2-EVO.

An Improper Neutralization of Delimiters vulnerability in the UI of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with high privileges to modify the system configuration.

A user with limited configuration and commit permissions, using a specifically crafted annotate configuration command, can change any part of the device configuration.

This issue affects:

Junos OS:

all versions before 22.2R3-S7, 22.4 versions before 22.4R3-S7, 23.2 versions before 23.2R2-S4, 23.4 versions before 23.4R2-S4, 24.2 versions before 24.2R2-S1, 24.4 versions before 24.4R1-S2, 24.4R2;

Junos OS Evolved:

all versions before 22.4R3-S7-EVO, 23.2-EVO versions before 23.2R2-S4-EVO, 23.4-EVO versions before 23.4R2-S5-EVO,  24.2-EVO versions before 24.2R2-S1-EVO

24.4-EVO versions before 24.4R2-EVO.

A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low privileged user to cause an impact to the availability of the device.

When RIB sharding is enabled and a user executes one of several routing related 'show' commands, a certain amount of memory is leaked. When all available memory has been consumed rpd will crash and restart.

The leak can be monitored with the CLI command:

show task memory detail | match taskshardmgmtcookie

where the allocated memory in bytes can be seen to continuously increase with each exploitation.

This issue affects:

Junos OS:

all versions before 21.2R3-S9, 21.4 versions before 21.4R3-S11, 22.2 versions before 22.2R3-S7, 22.4 versions before 22.4R3-S7, 23.2 versions before 23.2R2-S4,  23.4 versions before 23.4R2-S4, 24.2 versions before 24.2R2, 24.4 versions before 24.4R1-S2, 24.4R2;

Junos OS Evolved:

all versions before 22.2R3-S7-EVO 22.4-EVO versions before 22.4R3-S7-EVO, 23.2-EVO versions before 23.2R2-S4-EVO, 23.4-EVO versions before 23.4R2-S4-EVO, 24.2-EVO versions before 24.2R2-EVO,  24.4-EVO versions before 24.4R2-EVO.

A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).On all Junos OS and Junos OS Evolved devices, when route validation is enabled, a rare condition during BGP initial session establishment can lead to an rpd crash and restart. This occurs specifically when the connection request fails during error-handling scenario.

Continued session establishment failures leads to a sustained DoS condition.

This issue affects Junos OS:

All versions before 22.2R3-S6, from 22.4 before 22.4R3-S6, from 23.2 before 23.2R2-S3, from 23.4 before 23.4R2-S4, from 24.2 before 24.2R2;

Junos OS Evolved: All versions before 22.2R3-S6-EVO, from 22.4 before 22.4R3-S6-EVO, from 23.2 before 23.2R2-S3-EVO, from 23.4 before 23.4R2-S4-EVO, from 24.2 before 24.2R2-EVO.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to cause a Denial-of-Service (DoS).

When a specific "show bgp neighbor" CLI command is run, the rpd cpu utilization rises and eventually causes a crash and restart. Repeated use of this command will cause a sustained DoS condition.

The device is only affected if BGP RIB sharding and update-threading is enabled. This issue affects Junos OS:

All versions before 21.2R3-S9,  from 21.4 before 21.4R3-S8, from 22.2 before 22.2R3-S6,  from 22.4 before 22.4R3-S2,  from 23.2 before 23.2R2-S3,  from 23.4 before 23.4R2.

and Junos OS Evolved:

All versions before 21.2R3-S9-EVO,  from 21.4-EVO before 21.4R3-S8-EVO,  from 22.2-EVO before 22.2R3-S6-EVO,  from 22.4-EVO before 22.4R3-S2-EVO,  from 23.2-EVO before 23.2R2-S3-EVO,  from 23.4-EVO before 23.4R2-EVO.

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged, authenticated attacker with access to the CLI to access sensitive information.

Through the execution of a specific show mgd command, a user with limited permissions (e.g., a low-privileged login class user) can access sensitive information such as hashed passwords, that can be used to further impact the system.

This issue affects Junos OS:  All versions before 21.4R3-S10, from 22.2 before 22.2R3-S5, from 22.4 before 22.4R3-S5,  from 23.2 before 23.2R2-S3,  from 23.4 before 23.4R2-S3.

Junos OS Evolved:

All versions before 21.4R3-S10-EVO, from 22.2-EVO before 22.2R3-S6-EVO,  from 22.4-EVO before 22.4R3-S5-EVO,  from 23.2-EVO before 23.2R2-S3-EVO,  from 23.4-EVO before 23.4R2-S3-EVO.

An Improper Handling of Exceptional Conditions vulnerability in routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker executing a CLI command to cause a Denial of Service (DoS).

When asregex-optimized is configured and a specific "show route as-path" CLI command is executed, the rpd crashes and restarts. Repeated execution of this command will cause a sustained DoS condition. This issue affects Junos OS:

All versions before 21.2R3-S9, from 21.4 before 21.4R3-S10, from 22.2 before 22.2R3-S6, from 22.4 before 22.4R3-S6, from 23.2 before 23.2R2-S3, from 23.4 before 23.4R2-S4, from 24.2 before 24.2R2.

and Junos OS Evolved: All versions before 21.2R3-S9-EVO, from 21.4-EVO before 21.4R3-S10-EVO, from 22.2-EVO before 22.2R3-S6-EVO, from 22.4-EVO before 22.4R3-S6-EVO, from 23.2-EVO before 23.2R2-S3-EVO, from 23.4-EVO before 23.4R2-S4-EVO, from 24.2-EVO before 24.2R2-EVO.

An Incorrect Default Permissions vulnerability in the command line interface (CLI) of Juniper Networks Junos OS Evolved allows a low privileged local attacker to view NETCONF traceoptions files, representing an exposure of sensitive information.

On all Junos OS Evolved platforms, when NETCONF traceoptions are configured, NETCONF traceoptions files get created with an incorrect group permission, which allows

a low-privileged user can access sensitive information compromising the confidentiality of the system.

Junos OS Evolved:

All versions before 20.4R3-S9-EVO,  21.2-EVO before 21.2R3-S7-EVO,  21.4-EVO before 21.4R3-S5-EVO,  22.1-EVO before 22.1R3-S5-EVO,  22.2-EVO before 22.2R3-S3-EVO,  22.3-EVO before 22.3R3-EVO, 22.3R3-S2-EVO,  22.4-EVO before 22.4R3-EVO,  23.2-EVO before 23.2R1-S2-EVO, 23.2R2-EVO.

An Incorrect Comparison vulnerability in the local address verification API of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent attacker to create sessions or send traffic to the device using the network and broadcast address of the subnet assigned to an interface. This is unintended and unexpected behavior and can allow an attacker to bypass certain compensating controls, such as stateless firewall filters.

This issue affects Junos OS Evolved:

All versions before 21.4R3-S8-EVO,  22.2-EVO before 22.2R3-S4-EVO,  22.3-EVO before 22.3R3-S4-EVO,  22.4-EVO before 22.4R3-S3-EVO,  23.2-EVO before 23.2R2-S1-EVO,  23.4-EVO before 23.4R1-S2-EVO, 23.4R2-EVO.

An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to send arbitrary data to the device, which leads msvcsd process to crash with limited availability impacting Denial of Service (DoS) and allows unauthorized network access to the device, potentially impacting system integrity.

This issue only happens when inline jflow is configured.

This does not impact any forwarding traffic. The impacted services MSVCS-DB app crashes momentarily and recovers by itself.

This issue affects Juniper Networks Junos OS Evolved:  21.4 versions earlier than 21.4R3-S7-EVO;  22.2 versions earlier than 22.2R3-S3-EVO; 22.3 versions earlier than 22.3R3-S2-EVO; 22.4 versions earlier than 22.4R3-EVO; 23.2 versions earlier than 23.2R1-S2-EVO, 23.2R2-EVO.