An Out-of-bounds Write vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS), or Remote Code Execution (RCE) and obtain root privileges on the device.
This issue is caused by use of an insecure function allowing an attacker to overwrite arbitrary memory.
This issue affects Juniper Networks Junos OS SRX Series and EX Series:
Junos OS versions earlier than 20.4R3-S9; Junos OS 21.2 versions earlier than 21.2R3-S7; Junos OS 21.3 versions earlier than 21.3R3-S5; Junos OS 21.4 versions earlier than 21.4R3-S5; Junos OS 22.1 versions earlier than 22.1R3-S4; Junos OS 22.2 versions earlier than 22.2R3-S3; Junos OS 22.3 versions earlier than 22.3R3-S2; Junos OS 22.4 versions earlier than 22.4R2-S2, 22.4R3.
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series
and SRX Series
allows an unauthenticated, network-based attacker to remotely execute code.
Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.
This issue affects Juniper Networks Junos OS on EX Series
and
SRX Series:
All versions prior to
20.4R3-S9; 21.1 versions 21.1R1 and later; 21.2 versions prior to 21.2R3-S7; 21.3 versions prior to 21.3R3-S5; 21.4 versions prior to 21.4R3-S5; 22.1 versions
prior to
22.1R3-S4; 22.2 versions
prior to
22.2R3-S2; 22.3 versions
prior to
22.3R2-S2, 22.3R3-S1; 22.4 versions
prior to
22.4R2-S1, 22.4R3; 23.2 versions prior to 23.2R1-S1, 23.2R2.
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an attacker to construct a URL that when visited by another user enables the attacker to execute commands with the target's permissions, including an administrator.
A specific invocation of the emitdebugnote method in webauthoperation.php will echo back the data it receives.
This issue affects Juniper Networks Junos OS on SRX Series and EX Series: All versions earlier than 20.4R3-S10; 21.2 versions earlier than 21.2R3-S8; 21.4 versions earlier than 21.4R3-S6; 22.1 versions earlier than 22.1R3-S5; 22.2 versions earlier than 22.2R3-S3; 22.3 versions earlier than 22.3R3-S2; 22.4 versions earlier than 22.4R3-S1; 23.2 versions earlier than 23.2R2; 23.4 versions earlier than 23.4R2.
An Unchecked Return Value vulnerability in the user interfaces to the Juniper Networks Junos OS and Junos OS Evolved, the CLI, the XML API, the XML Management Protocol, the NETCONF Management Protocol, the gNMI interfaces, and the J-Web User Interfaces causes unintended effects such as demotion or elevation of privileges associated with an operators actions to occur.
Multiple scenarios may occur; for example: privilege escalation over the device or another account, access to files that should not otherwise be accessible, files not being accessible where they should be accessible, code expected to run as non-root may run as root, and so forth.
This issue affects:
Juniper Networks Junos OS
All versions prior to 20.4R3-S7; 21.1 versions prior to 21.1R3-S5; 21.2 versions prior to 21.2R3-S5; 21.3 versions prior to 21.3R3-S4; 21.4 versions prior to 21.4R3-S3; 22.1 versions prior to 22.1R3-S2; 22.2 versions prior to 22.2R2-S2, 22.2R3; 22.3 versions prior to 22.3R1-S2, 22.3R2.
Juniper Networks Junos OS Evolved
All versions prior to 21.4R3-S3-EVO; 22.1-EVO version 22.1R1-EVO and later versions prior to 22.2R2-S2-EVO, 22.2R3-EVO; 22.3-EVO versions prior to 22.3R1-S2-EVO, 22.3R2-EVO.
An OS Command Injection vulnerability in gRPC Network Operations Interface (gNOI) server module of Juniper Networks Junos OS Evolved allows an authenticated, low privileged, network based attacker to inject shell commands and execute code. This issue affects Juniper Networks Junos OS Evolved 21.4 version 21.4R1-EVO and later versions prior to 22.1R1-EVO.
An Improper Validation of Syntactic Correctness of Input vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS).
If a BGP update is received over an established BGP session which contains a tunnel encapsulation attribute with a specifically malformed TLV, rpd will crash and restart.
This issue affects Juniper Networks Junos OS: 20.4 versions 20.4R1 and later versions earlier than 20.4R3-S9; 21.2 versions earlier than 21.2R3-S7; 21.3 versions earlier than 21.3R3-S5; 21.4 versions earlier than 21.4R3-S5; 22.1 versions earlier than 22.1R3-S4; 22.2 versions earlier than 22.2R3-S3; 22.3 versions earlier than 22.3R3-S1; 22.4 versions earlier than 22.4R3; 23.2 versions earlier than 23.2R1-S2, 23.2R2;
Junos OS Evolved: 20.4-EVO versions 20.4R1-EVO and later versions earlier than 20.4R3-S9-EVO; 21.2-EVO versions earlier than 21.2R3-S7-EVO; 21.3-EVO versions earlier than 21.3R3-S5-EVO; 21.4-EVO versions earlier than 21.4R3-S5-EVO; 22.1-EVO versions earlier than 22.1R3-S4-EVO; 22.2-EVO versions earlier than 22.2R3-S3-EVO; 22.3-EVO versions earlier than 22.3R3-S1-EVO; 22.4-EVO versions earlier than 22.4R3-EVO; 23.2-EVO versions earlier than 23.2R1-S2-EVO, 23.2R2-EVO;
This issue does not affect Juniper Networks Junos OS versions earlier than 20.4R1; Junos OS Evolved versions earlier than 20.4R1-EVO.
This is a related but separate issue than the one described in JSA79095.
An Improper Validation of Specified Type of Input vulnerability in Routing Protocol Daemon (RPD) of Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause Denial of Service (DoS).
If a BGP update is received over an established BGP session which contains a tunnel encapsulation attribute with a specifically malformed TLV, rpd will crash and restart. This issue affects:
Junos OS:
all versions before 21.2R3-S7,
from 21.3 before 21.3R3-S5,
from 21.4 before 21.4R3-S5,
from 22.1 before 22.1R3-S5,
from 22.2 before 22.2R3-S3,
from 22.3 before 22.3R3-S2,
from 22.4 before 22.4R3,
from 23.2 before 23.2R1-S2, 23.2R2.
Junos OS Evolved:
all versions before 21.2R3-S7-EVO,
from 21.3-EVO before 21.3R3-S5-EVO,
from 21.4-EVO before 21.4R3-S5-EVO, from 22.2-EVO before 22.2R3-S3-EVO,
from 22.3-EVO before 22.3R3-S2-EVO,
from 22.4-EVO before 22.4R3-EVO,
from 23.2-EVO before 23.2R1-S2-EVO, 23.2R2-EVO.
This is a related but separate issue than the one described in JSA75739
A Stack-based Buffer Overflow vulnerability in the Routing Protocol Daemon (RPD) component of Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause an rpd crash, leading to Denial of Service (DoS).
On all Junos OS and Junos OS Evolved platforms, when EVPN is configured, and a specific EVPN type-5 route is received via BGP, rpd crashes and restarts. Continuous receipt of this specific route will lead to a sustained Denial of Service (DoS) condition.
This issue affects: Junos OS:
all versions before 21.2R3-S7,
from 21.4 before 21.4R3-S5,
from 22.1 before 22.1R3-S4,
from 22.2 before 22.2R3-S2,
from 22.3 before 22.3R3-S1,
from 22.4 before 22.4R3,
from 23.2 before 23.2R2.
Junos OS Evolved:
all versions before 21.4R3-S5-EVO,
from 22.1-EVO before 22.1R3-S4-EVO,
from 22.2-EVO before 22.2R3-S2-EVO,
from 22.3-EVO before 22.3R3-S1-EVO,
from 22.4-EVO before 22.4R3-EVO,
from 23.2-EVO before 23.2R2-EVO.
A Stack-based Buffer Overflow vulnerability in Flow Processing Daemon (flowd) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service (DoS).
On all Junos OS MX Series platforms with SPC3 and MS-MPC/-MIC, when URL filtering is enabled and a specific URL request is received and processed, flowd will crash and restart. Continuous reception of the specific URL request will lead to a sustained Denial of Service (DoS) condition.
This issue affects: Junos OS:
all versions before 21.2R3-S6,
from 21.3 before 21.3R3-S5,
from 21.4 before 21.4R3-S5,
from 22.1 before 22.1R3-S3,
from 22.2 before 22.2R3-S1,
from 22.3 before 22.3R2-S2, 22.3R3,
from 22.4 before 22.4R2-S1, 22.4R3.
An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based, unauthenticated attacker to send a specific routing update, causing an rpd core due to memory corruption, leading to a Denial of Service (DoS).
This issue can only be triggered when the system is configured for CoS-based forwarding (CBF) with a policy map containing a cos-next-hop-map action (see below). This issue affects: Junos OS:
all versions before 20.4R3-S10, from 21.2 before 21.2R3-S8, from 21.3 before 21.3R3, from 21.4 before 21.4R3, from 22.1 before 22.1R2;
Junos OS Evolved:
all versions before 21.2R3-S8-EVO, from 21.3 before 21.3R3-EVO, from 21.4 before 21.4R3-EVO, from 22.1 before 22.1R2-EVO.
An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specific malformed BGP update message to cause the session to reset, resulting in a Denial of Service (DoS). Continued receipt and processing of these malformed BGP update messages will create a sustained Denial of Service (DoS) condition.
Upon receipt of a BGP update message over an established BGP session containing a specifically malformed tunnel encapsulation attribute, when segment routing is enabled, internal processing of the malformed attributes within the update results in improper parsing of remaining attributes, leading to session reset:
BGP SEND Notification code 3 (Update Message Error) subcode 1 (invalid attribute list)
Only systems with segment routing enabled are vulnerable to this issue.
This issue affects eBGP and iBGP, in both IPv4 and IPv6 implementations, and requires a remote attacker to have at least one established BGP session.
This issue affects:
Junos OS:
All versions before 21.4R3-S8, from 22.2 before 22.2R3-S4, from 22.3 before 22.3R3-S3, from 22.4 before 22.4R3-S3, from 23.2 before 23.2R2-S1, from 23.4 before 23.4R1-S2, 23.4R2.
Junos OS Evolved:
All versions before 21.4R3-S8-EVO, from 22.2-EVO before 22.2R3-S4-EVO, from 22.3-EVO before 22.3R3-S3-EVO, from 22.4-EVO before 22.4R3-S3-EVO, from 23.2-EVO before 23.2R2-S1-EVO, from 23.4-EVO before 23.4R1-S2-EVO, 23.4R2-EVO.
A Missing Release of Resource after Effective Lifetime vulnerability the xinetd process, responsible for spawning SSH daemon (sshd) instances, of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to cause a Denial of Service (DoS) by blocking SSH access for legitimate users. Continued receipt of these connections will create a sustained Denial of Service (DoS) condition.
The issue is triggered when a high rate of concurrent SSH requests are received and terminated in a specific way, causing xinetd to crash, and leaving defunct sshd processes. Successful exploitation of this vulnerability blocks both SSH access as well as services which rely upon SSH, such as SFTP, and Netconf over SSH.
Once the system is in this state, legitimate users will be unable to SSH to the device until service is manually restored. See WORKAROUND section below.
Administrators can monitor an increase in defunct sshd processes by utilizing the CLI command:
> show system processes | match sshd root 25219 30901 0 Jul16 ? 00:00:00 [sshd] <defunct>
This issue affects Juniper Networks Junos OS Evolved: All versions prior to 21.4R3-S7-EVO 22.3-EVO versions prior to 22.3R2-S2-EVO, 22.3R3-S2-EVO; 22.4-EVO versions prior to 22.4R3-EVO; 23.2-EVO versions prior to 23.2R2-EVO.
This issue does not affect Juniper Networks Junos OS Evolved 22.1-EVO nor 22.2-EVO.
A Use of Externally-Controlled Format String vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
If DNS Domain Generation Algorithm (DGA) detection or tunnel detection, and DNS-filtering traceoptions are configured, and specific valid transit DNS traffic is received this causes a PFE crash and restart, leading to a Denial of Service.
This issue affects Junos OS: All versions before 21.4R3-S6, 22.2 versions before 22.2R3-S3, 22.3 versions before 22.3R3-S3, 22.4 versions before 22.4R3, 23.2 versions before 23.2R2.
An Improper Check for Unusual or Exceptional Conditions vulnerability in the the IKE daemon (iked) of Juniper Networks Junos OS on SRX Series, MX Series with SPC3 and NFX350 allows allows an unauthenticated, network-based attacker sending specific mismatching parameters as part of the IPsec negotiation to trigger an iked crash leading to Denial of Service (DoS).
This issue is applicable to all platforms that run iked. This issue affects Junos OS on SRX Series, MX Series with SPC3 and NFX350:
All versions before 21.2R3-S8, from 21.4 before 21.4R3-S7, from 22.1 before 22.1R3-S2, from 22.2 before 22.2R3-S1, from 22.3 before 22.3R2-S1, 22.3R3, from 22.4 before 22.4R1-S2, 22.4R2, 22.4R3.
A Missing Release of Memory after Effective Lifetime vulnerability in the routing process daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to send a malformed BGP Path attribute update which allocates memory used to log the bad path attribute. This memory is not properly freed in all circumstances, leading to a Denial of Service (DoS).
Consumed memory can be freed by manually restarting Routing Protocol Daemon (rpd).
Memory utilization could be monitored by: user@host> show system memory or show system monitor memory status
This issue affects:
Junos OS: All versions before 21.2R3-S8, from 21.4 before 21.4R3-S8,
from 22.2 before 22.2R3-S4, from 22.3 before 22.3R3-S3, from 22.4 before 22.4R3-S3, from 23.2 before 23.2R2-S1, from 23.4 before 23.4R1-S2, 23.4R2.
Junos OS Evolved: All versions before 21.2R3-S8-EVO, from 21.4 before 21.4R3-S8-EVO, from 22.2 before 22.2R3-S4-EVO, from 22.3 before 22.3R3-S3-EVO, from 22.4 before 22.4R3-S3-EVO,
from 23.2 before 23.2R2-S1-EVO, from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO.
An Uncontrolled Resource Consumption vulnerability in the H.323 ALG (Application Layer Gateway) of Juniper Networks Junos OS on SRX Series and MX Series with SPC3 and MS-MPC/MIC, allows an unauthenticated network-based attacker to send specific packets causing traffic loss leading to Denial of Service (DoS).
Continued receipt and processing of these specific packets will sustain the Denial of Service condition.
The memory usage can be monitored using the below command.
user@host> show usp memory segment sha data objcache jsf This issue affects SRX Series and MX Series with SPC3 and MS-MPC/MIC:
20.4 before 20.4R3-S10, 21.2 before 21.2R3-S6, 21.3 before 21.3R3-S5, 21.4 before 21.4R3-S6, 22.1 before 22.1R3-S4, 22.2 before 22.2R3-S2, 22.3 before 22.3R3-S1, 22.4 before 22.4R3, 23.2 before 23.2R2.
An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a network based, unauthenticated attacker to cause the RPD process to crash leading to a Denial of Service (DoS).
When a malformed BGP UPDATE packet is received over an established BGP session, RPD crashes and restarts.
Continuous receipt of the malformed BGP UPDATE messages will create a sustained Denial of Service (DoS) condition for impacted devices.
This issue affects eBGP and iBGP, in both IPv4 and IPv6 implementations. This issue requires a remote attacker to have at least one established BGP session.
This issue affects: Juniper Networks Junos OS: All versions earlier than 20.4R3-S9; 21.2 versions earlier than 21.2R3-S7; 21.3 versions earlier than 21.3R3-S5; 21.4 versions earlier than 21.4R3-S6; 22.1 versions earlier than 22.1R3-S4; 22.2 versions earlier than 22.2R3-S3; 22.3 versions earlier than 22.3R3-S2; 22.4 versions earlier than 22.4R3; 23.2 versions earlier than 23.2R2.
Juniper Networks Junos OS Evolved: All versions earlier than 21.2R3-S7; 21.3-EVO versions earlier than 21.3R3-S5; 21.4-EVO versions earlier than 21.4R3-S8; 22.1-EVO versions earlier than 22.1R3-S4; 22.2-EVO versions earlier than 22.2R3-S3; 22.3-EVO versions earlier than 22.3R3-S2; 22.4-EVO versions earlier than 22.4R3; 23.2-EVO versions earlier than 23.2R2.
An Out-of-Bounds Read vulnerability in
the routing protocol daemon (rpd) of
Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.
This issue only affects systems configured in either of two ways:
systems with BGP traceoptions enabled
systems with BGP traffic engineering configured
This issue can affect iBGP and eBGP with
any address family
configured. The specific attribute involved is non-transitive, and will not propagate across a network.
This issue affects:
Junos OS:
All versions before 21.4R3-S8, 22.2 before 22.2R3-S5, 22.3 before 22.3R3-S4, 22.4 before 22.4R3-S3, 23.2 before 23.2R2-S2, 23.4 before 23.4R2;
Junos OS Evolved:
All versions before 21.4R3-S8-EVO, 22.2-EVO before 22.2R3-S5-EVO, 22.3-EVO before 22.3R3-S4-EVO, 22.4-EVO before 22.4R3-S3-EVO, 23.2-EVO before 23.2R2-S2-EVO, 23.4-EVO before 23.4R2-EVO.
An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specific BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.
This issue only affects systems with BGP traceoptions enabled and
requires a BGP session to be already established. Systems without BGP traceoptions enabled are not affected by this issue.
This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.
This issue affects:
Junos OS:
All versions before 21.2R3-S8, from 21.4 before 21.4R3-S8, from 22.2 before 22.2R3-S4, from 22.3 before 22.3R3-S4, from 22.4 before 22.4R3-S3, from 23.2 before 23.2R2-S1, from 23.4 before 23.4R2;
Junos OS Evolved:
All versions before 21.2R3-S8-EVO, from 21.4-EVO before 21.4R3-S8-EVO, from 22.2-EVO before 22.2R3-S4-EVO, from 22.3-EVO before 22.3R3-S4-EVO, from 22.4-EVO before 22.4R3-S3-EVO, from 23.2-EVO before 23.2R2-S1-EVO, from 23.4-EVO before 23.4R2-EVO.
An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.
In some cases, rpd fails to restart requiring a manual restart via the 'restart routing' CLI command.
This issue only affects systems with BGP traceoptions enabled and
requires a BGP session to be already established. Systems without BGP traceoptions enabled are not affected by this issue.
This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.
This issue affects:
Junos OS:
All versions before 21.4R3-S8, 22.2 before 22.2R3-S5, 22.3 before 22.3R3-S4, 22.4 before 22.4R3-S3, 23.2 before 23.2R2-S2, 23.4 before 23.4R2;
Junos OS Evolved:
All versions before 21.4R3-S8-EVO, 22.2-EVO before 22.2R3-S5-EVO, 22.3-EVO before 22.3R3-S4-EVO, 22.4-EVO before 22.4R3-S3-EVO, 23.2-EVO before 23.2R2-S2-EVO, 23.4-EVO before 23.4R2-EVO.
An Improper Handling of Exceptional Conditions vulnerability in the rpd-server of Juniper Networks Junos OS and Junos OS Evolved within cRPD allows an unauthenticated network-based attacker sending crafted TCP traffic to the routing engine (RE) to cause a CPU-based Denial of Service (DoS).
If specially crafted TCP traffic is received by the control plane, or a TCP session terminates unexpectedly, it will cause increased control plane CPU utilization by the rpd-server process.
While not explicitly required, the impact is more severe when RIB sharding is enabled.
Task accounting shows unexpected reads by the RPD Server jobs for shards:
user@junos> show task accounting detail ... read:RPD Server.0.0.0.0+780.192.168.0.78+48886 TOT:00000003.00379787 MAX:00000000.00080516 RUNS: 233888\ read:RPD Server.0.0.0.0+780.192.168.0.78+49144 TOT:00000004.00007565 MAX:00000000.00080360 RUNS: 233888\ read:RPD Server.0.0.0.0+780.192.168.0.78+49694 TOT:00000003.00600584 MAX:00000000.00080463 RUNS: 233888\ read:RPD Server.0.0.0.0+780.192.168.0.78+50246 TOT:00000004.00346998 MAX:00000000.00080338 RUNS: 233888\
This issue affects:
Junos OS with cRPD:
All versions before 21.2R3-S8, 21.4 before 21.4R3-S7, 22.1 before 22.1R3-S6, 22.2 before 22.2R3-S4, 22.3 before 22.3R3-S3, 22.4 before 22.4R3-S2, 23.2 before 23.2R2-S2, 24.2 before 24.2R2;
Junos OS Evolved with cRPD:
All versions before 21.4R3-S7-EVO, 22.2 before 22.2R3-S4-EVO, 22.3 before 22.3R3-S3-EVO, 22.4 before 22.4R3-S2-EVO, 23.2 before 23.2R2-EVO.
An Uncontrolled Resource Consumption vulnerability in the http daemon (httpd) of Juniper Networks Junos OS on SRX Series, QFX Series, MX Series and EX Series allows an unauthenticated, network-based attacker to cause Denial-of-Service (DoS).
An attacker can send specific HTTPS connection requests to the device, triggering the creation of processes that are not properly terminated. Over time, this leads to resource exhaustion, ultimately causing the device to crash and restart.
The following command can be used to monitor the resource usage: user@host> show system processes extensive | match mgd | count
This issue affects Junos OS on SRX Series and EX Series: All versions before 21.4R3-S7, from 22.2 before 22.2R3-S4, from 22.3 before 22.3R3-S3, from 22.4 before 22.4R3-S2, from 23.2 before 23.2R2-S1, from 23.4 before 23.4R1-S2, 23.4R2.
An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS).
In a scenario where BGP Monitoring Protocol (BMP) is configured with rib-in pre-policy monitoring, receiving a BGP update with a specifically malformed AS PATH attribute over an established BGP session, can cause an RPD crash and restart.
This issue affects:
Junos OS:
All versions before 21.2R3-S8, 21.4 versions before 21.4R3-S8, 22.2 versions before 22.2R3-S4, 22.3 versions before 22.3R3-S3, 22.4 versions before 22.4R3-S2, 23.2 versions before 23.2R2-S1, 23.4 versions before 23.4R1-S2, 23.4R2;
Junos OS Evolved:
All versions before 21.2R3-S8-EVO, 21.4 versions before 21.4R3-S8-EVO, 22.2 versions before 22.2R3-S4-EVO, 22.3 versions before 22.3R3-S3-EVO, 22.4 versions before 22.4R3-S2-EVO, 23.2 versions before 23.2R2-S1-EVO, 23.4 versions before 23.4R1-S2-EVO, 23.4R2-EVO.
This is a similar, but different vulnerability than the issue reported as CVE-2024-39549.
A double-free vulnerability in the routing process daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to send a malformed BGP Path attribute update which allocates memory used to log the bad path attribute. This double free of memory is causing an rpd crash, leading to a Denial of Service (DoS).
This issue affects:
Junos OS: from 22.4 before 22.4R3-S4.
Junos OS Evolved: from 22.4 before 22.4R3-S4-EVO.
An Improper Check for Unusual or Exceptional Conditions vulnerability in the pfe (packet forwarding engine) of Juniper Networks Junos OS on MX Series causes a port within a pool to be blocked leading to Denial of Service (DoS).
In a DS-Lite (Dual-Stack Lite) and NAT (Network Address Translation) scenario, when crafted IPv6 traffic is received and prefix-length is set to 56, the ports assigned to the user will not be freed. Eventually, users cannot establish new connections. Affected FPC/PIC need to be manually restarted to recover. Following is the command to identify the issue:
user@host> show services nat source port-block HostIP ExternalIP PortBlock PortsUsed/ BlockState/ Range PortsTotal LeftTime(s) 2001:: x.x.x.x 58880-59391 256/2561 Active/- >>>>>>>>port still usedThis issue affects Junos OS on MX Series:
from 21.2 before 21.2R3-S8, from 21.4 before 21.4R3-S7, from 22.1 before 22.1R3-S6, from 22.2 before 22.2R3-S4, from 22.3 before 22.3R3-S3, from 22.4 before 22.4R3-S2, from 23.2 before 23.2R2-S1, from 23.4 before 23.4R1-S2, 23.4R2.
This issue does not affect versions before 20.2R1.
A NULL Pointer Dereference vulnerability in the flow daemon (flowd) of Juniper Networks Junos OS on SRX Series allows an attacker causing specific, valid control traffic to be sent out of a Dual-Stack (DS) Lite tunnel to crash the flowd process, resulting in a Denial of Service (DoS). Continuous triggering of specific control traffic will create a sustained Denial of Service (DoS) condition.
On all SRX platforms, when specific, valid control traffic needs to be sent out of a DS-Lite tunnel, a segmentation fault occurs within the flowd process, resulting in a network outage until the flowd process restarts.
This issue affects Junos OS on SRX Series: All versions before 21.2R3-S9, from 21.4 before 21.4R3-S9, from 22.2 before 22.2R3-S5, from 22.4 before 22.4R3-S6, from 23.2 before 23.2R2-S3, from 23.4 before 23.4R2.
A Buffer Access with Incorrect Length Value vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When an attacker sends a specific ICMPv6 packet to an interface with "protocols router-advertisement" configured, rpd crashes and restarts. Continued receipt of this packet will cause a sustained DoS condition.
This issue only affects systems configured with IPv6.
This issue affects Junos OS:
All versions before 21.2R3-S9, from 21.4 before 21.4R3-S10, from 22.2 before 22.2R3-S6, from 22.4 before 22.4R3-S4, from 23.2 before 23.2R2-S2, from 23.4 before 23.4R2;
and Junos OS Evolved: All versions before 21.2R3-S9-EVO, from 21.4-EVO before 21.4R3-S10-EVO, from 22.2-EVO before 22.2R3-S6-EVO, from 22.4-EVO before 22.4R3-S4-EVO, from 23.2-EVO before 23.2R2-S2-EVO, from 23.4-EVO before 23.4R2-EVO.
An Improper Handling of Additional Special Element vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with MS-MPC, MS-MIC and SPC3, and SRX Series, allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
If the SIP ALG processes specifically formatted SIP invites, a memory corruption will occur which will lead to a crash of the FPC processing these packets. Although the system will automatically recover with the restart of the FPC, subsequent SIP invites will cause the crash again and lead to a sustained DoS.
This issue affects Junos OS on MX Series and SRX Series:
all versions before 21.2R3-S9, 21.4 versions before 21.4R3-S10, 22.2 versions before 22.2R3-S6, 22.4 versions before 22.4R3-S5, 23.2 versions before 23.2R2-S3, 23.4 versions before 23.4R2-S3, 24.2 versions before 24.2R1-S2, 24.2R2.
An Improper Handling of Length Parameter Inconsistency vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
When a device configured for Secure Vector Routing (SVR) receives a specifically malformed packet the PFE will crash and restart. This issue affects Junos OS on SRX Series:
All 21.4 versions, 22.2 versions before 22.2R3-S6, 22.4 versions before 22.4R3-S6, 23.2 versions before 23.2R2-S3, 23.4 versions before 23.4R2-S4, 24.2 versions before 24.2R2.
This issue does not affect versions before 21.4.
A Missing Release of Memory after Effective Lifetime vulnerability in the Anti-Virus processing of Juniper Networks Junos OS on SRX Series
allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
On all SRX platforms with Anti-Virus enabled, if a server sends specific content in the HTTP body of a response to a client request, these packets are queued by Anti-Virus processing in Juniper Buffers (jbufs) which are never released. When these jbufs are exhausted, the device stops forwarding all transit traffic.
A jbuf memory leak can be noticed from the following logs:
(<node>.)<fpc> Warning: jbuf pool id <#> utilization level (<current level>%) is above <threshold>%!
To recover from this issue, the affected device needs to be manually rebooted to free the leaked jbufs.
This issue affects Junos OS on SRX Series:
all versions before 21.2R3-S9, 21.4 versions before 21.4R3-S10, 22.2 versions before 22.2R3-S6, 22.4 versions before 22.4R3-S6, 23.2 versions before 23.2R2-S3, 23.4 versions before 23.4R2-S3, 24.2 versions before 24.2R2.