An Improper Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS allows an unauthenticated, network-adjacent attacker sending a specifically malformed ICMP packet to cause an FPC to crash and restart, resulting in a Denial of Service (DoS).

When an ICMP packet is received with a specifically malformed IP header value, the FPC receiving the packet crashes and restarts. Due to the specific type of malformed packet, adjacent upstream routers would not forward the packet, limiting the attack surface to adjacent networks.

This issue only affects ICMPv4. ICMPv6 is not vulnerable to this issue.

This issue does not affect AFT-based line cards such as the MPC10, MPC11, LC4800, LC9600, and MX304.

This issue affects Junos OS:

all versions before 21.2R3-S9,  from 21.4 before 21.4R3-S10,  from 22.2 before 22.2R3-S7,  from 22.3 before 22.3R3-S4,  from 22.4 before 22.4R3-S5,  from 23.2 before 23.2R2-S3,  from 23.4 before 23.4R2-S3,  from 24.2 before 24.2R1-S2, 24.2R2.

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a high privileged, local attacker to escalated their privileges to root.

When a user provides specifically crafted arguments to the 'request system logout' command, these will be executed as root on the shell, which can completely compromise the device. This issue affects:

Junos OS:

all versions before 21.2R3-S9, 21.4 versions before 21.4R3-S8, 22.2 versions before 22.2R3-S6, 22.3 versions before 22.3R3-S3, 22.4 versions before 22.4R3-S6, 23.2 versions before 23.2R2-S1, 23.4 versions before 23.4R1-S2, 23.4R2;

Junos OS Evolved:

all versions before 22.4R3-S6-EVO, 23.2-EVO versions before 23.2R2-S1-EVO, 23.4-EVO versions before 23.4R1-S2-EVO, 23.4R2-EVO.

A Use of Incorrect Byte Ordering

vulnerability

in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS on SRX300 Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

When a BGP update is received over an established BGP session which contains a specific, valid, optional, transitive path attribute, rpd will crash and restart.

This issue affects eBGP and iBGP over IPv4 and IPv6.

This issue affects:

Junos OS:

22.1 versions from 22.1R1 before 22.2R3-S4, 22.3 versions before 22.3R3-S3, 22.4 versions before 22.4R3-S2, 23.2 versions before 23.2R2, 23.4 versions before 23.4R2.

A Reachable Assertion vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).

When the device receives a specific BGP UPDATE packet, the rpd crashes and restarts. Continuous receipt of this specific packet will cause a sustained DoS condition.

For the issue to occur, BGP multipath with "pause-computation-during-churn" must be configured on the device, and the attacker must send the paths via a BGP UPDATE from a established BGP peer.

This issue affects: Junos OS: All versions before 21.4R3-S7, from 22.3 before 22.3R3-S3, from 22.4 before 22.4R3-S5, from 23.2 before 23.2R2, from 23.4 before 23.4R2.

Junos OS Evolved: All versions before 21.4R3-S7-EVO, from 22.3 before 22.3R3-S3-EVO, from 22.4 before 22.4R3-S5-EVO, from 23.2 before 23.2R2-EVO, from 23.4 before 23.4R2-EVO.

A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause an FPC to crash, leading to Denial of Service (DoS).

On all Junos OS and Junos OS Evolved platforms, in an EVPN-VXLAN scenario, when specific ARP packets are received on an IPv4 network, or specific NDP packets are received on an IPv6 network, kernel heap memory leaks, which eventually leads to an FPC crash and restart.

This issue does not affect MX Series platforms. Heap size growth on FPC can be seen using below command.

user@host> show chassis fpc                     Temp CPU Utilization (%) CPU Utilization (%) Memory   Utilization (%) Slot State           (C) Total Interrupt     1min   5min   15min   DRAM (MB)   Heap   Buffer   0 Online           45     3         0       2       2      2       32768      19       0 <<<<<<< Heap increase in all fPCs

This issue affects Junos OS:

All versions before 21.2R3-S7, 21.4 versions before 21.4R3-S4, 22.2 versions before 22.2R3-S1,  22.3 versions before 22.3R3-S1,  22.4 versions before 22.4R2-S2, 22.4R3.

and Junos OS Evolved:

All versions before 21.2R3-S7-EVO, 21.4-EVO versions before 21.4R3-S4-EVO, 22.2-EVO versions before 22.2R3-S1-EVO,  22.3-EVO versions before 22.3R3-S1-EVO,

22.4-EVO versions before 22.4R3-EVO.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the pfe (packet forwarding engine) of Juniper Networks Junos OS on MX Series causes a port within a pool to be blocked leading to Denial of Service (DoS).

In a DS-Lite (Dual-Stack Lite) and NAT (Network Address Translation) scenario, when crafted IPv6 traffic is received and prefix-length is set to 56, the ports assigned to the user will not be freed.  Eventually, users cannot establish new connections. Affected FPC/PIC need to be manually restarted to recover. Following is the command to identify the issue:

user@host> show services nat source port-block      HostIP                     ExternalIP                   PortBlock      PortsUsed/       BlockState/                                                               Range           PortsTotal       LeftTime(s)     2001::                        x.x.x.x                     58880-59391     256/2561         Active/-       >>>>>>>>port still usedThis issue affects Junos OS on MX Series:

from 21.2 before 21.2R3-S8,  from 21.4 before 21.4R3-S7,  from 22.1 before 22.1R3-S6,  from 22.2 before 22.2R3-S4,  from 22.3 before 22.3R3-S3,  from 22.4 before 22.4R3-S2,  from 23.2 before 23.2R2-S1,  from 23.4 before 23.4R1-S2, 23.4R2.

This issue does not affect versions before 20.2R1.

This is a similar, but different vulnerability than the issue reported as CVE-2024-39549.

A double-free vulnerability in the routing process daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to send a malformed BGP Path attribute update which allocates memory used to log the bad path attribute. This double free of memory is causing an rpd crash, leading to a Denial of Service (DoS).

This issue affects:

Junos OS:  from 22.4 before 22.4R3-S4.

Junos OS Evolved: from 22.4 before 22.4R3-S4-EVO.

An Out-of-Bounds Read vulnerability in

the routing protocol daemon (rpd) of

Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue only affects systems configured in either of two ways:

systems with BGP traceoptions enabled

systems with BGP family traffic-engineering (BGP-LS) configured

and can be exploited from a directly connected and configured BGP peer.

This issue affects iBGP and eBGP

with

any address family

configured, and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects:

Junos OS:

from 21.4 before 21.4R3-S9,  from 22.2 before 22.2R3-S5,  from 22.3 before 22.3R3-S4,  from 22.4 before 22.4R3-S5,  from 23.2 before 23.2R2-S3,  from 23.4 before 23.4R2-S3,  from 24.2 before 24.2R1-S2, 24.2R2;

Junos OS Evolved:

from 21.4-EVO before 21.4R3-S9-EVO,  from 22.2-EVO before 22.2R3-S5-EVO,  from 22.3-EVO before 22.3R3-S4-EVO,  from 22.4-EVO before 22.4R3-S5-EVO,  from 23.2-EVO before 23.2R2-S3-EVO,  from 23.4-EVO before 23.4R2-S2-EVO,  from 24.2-EVO before 24.2R1-S2-EVO, 24.2R2-EVO.

This issue does not affect versions of Junos OS prior to 21.3R1.

This issue does not affect versions of Junos OS Evolved prior to 21.3R1-EVO.

This is a similar, but different vulnerability than the issue reported as CVE-2024-39516.

An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker sending a specific BGP update packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS).

Continuous receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects Junos OS:

from 21.4 before 21.4R3-S9,  from 22.2 before 22.2R3-S5,  from 22.3 before 22.3R3-S4, from 22.4 before 22.4R3-S5,  from 23.2 before 23.2R2-S3,  from 23.4 before 23.4R2-S3,  from 24.2 before 24.2R1-S2, 24.2R2;

This issue does not affect versions prior to 21.1R1.

Junos OS Evolved:

from 21.4 before 21.4R3-S9-EVO,  from 22.2 before 22.2R3-S5-EVO,  from 22.3 before 22.3R3-S4-EVO, from 22.4 before 22.4R3-S5-EVO,  from 23.2 before 23.2R2-S3-EVO,  from 23.4 before 23.4R2-S3-EVO,  from 24.2 before 24.2R1-S2-EVO, 24.2R2-EVO.

This issue does not affect versions prior to 21.1R1-EVO

An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a Denial-of-Service (DoS).

On devices with SRv6 (Segment Routing over IPv6) enabled, an attacker can send a malformed BGP UPDATE packet which will cause the rpd to crash and restart. Continued receipt of these UPDATE packets will cause a sustained DoS condition.

This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.This issue affects Junos OS:

All versions before 21.2R3-S9,  from 21.4 before 21.4R3-S10,  from 22.2 before 22.2R3-S5,  from 22.3 before 22.3R3-S4,  from 22.4 before 22.4R3-S3,  from 23.2 before 23.2R2-S2,  from 23.4 before 23.4R2;

and Junos OS Evolved:

All versions before 21.2R3-S9-EVO,  from 21.4-EVO before 21.4R3-S10-EVO,  from 22.2-EVO before 22.2R3-S5-EVO,  from 22.3-EVO before 22.3R3-S4-EVO,  from 22.4-EVO before 22.4R3-S3-EVO, from 23.2-EVO before 23.2R2-S2-EVO,  from 23.4-EVO before 23.4R2-EVO.

An Improper Validation of Specified Type of Input vulnerability in the packet forwarding engine (pfe) Juniper Networks Junos OS on SRX5000 Series allows an unauthenticated, network based attacker to cause a Denial of Service (Dos).

When a non-clustered SRX5000 device receives a specifically malformed packet this will cause a flowd crash and restart.

This issue affects Junos OS:

22.1 releases 22.1R1 and later before 22.2R3-S5, 22.3 releases before 22.3R3-S4, 22.4 releases before 22.4R3-S4, 23.2 releases before 23.2R2-S2, 23.4 releases before 23.4R2-S1, 24.2 releases before 24.2R1-S1, 24.2R2.

Please note that the PR does indicate that earlier versions have been fixed as well, but these won't be adversely impacted by this.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX4600 and SRX5000 Series allows an unauthenticated and logically adjacent attacker to cause a Denial-of-Service (DoS).

If in a multicast scenario a sequence of

specific PIM packets is received, this will cause a flowd crash and restart, which leads to momentary service interruption. This issue affects Junos OS on SRX 4600 and SRX 5000 Series:

All versions before 21.4R3-S9, 22.2 versions before 22.2R3-S5, 22.3 versions before 22.3R3-S4, 22.4 versions before 22.4R3-S4, 23.2 versions before 23.2R2-S2, 23.4 versions before 23.4R2,  24.2 versions before 24.2R1-S1, 24.2R2.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS).

In a scenario where BGP Monitoring Protocol (BMP) is configured with rib-in pre-policy monitoring, receiving a BGP update with a specifically malformed AS PATH attribute over an established BGP session, can cause an RPD crash and restart.

This issue affects:

Junos OS:

All versions before 21.2R3-S8, 21.4 versions before 21.4R3-S8, 22.2 versions before 22.2R3-S4, 22.3 versions before 22.3R3-S3, 22.4 versions before 22.4R3-S2, 23.2 versions before 23.2R2-S1, 23.4 versions before 23.4R1-S2, 23.4R2;

Junos OS Evolved:

All versions before 21.2R3-S8-EVO, 21.4 versions before 21.4R3-S8-EVO, 22.2 versions before 22.2R3-S4-EVO, 22.3 versions before 22.3R3-S3-EVO, 22.4 versions before 22.4R3-S2-EVO, 23.2 versions before 23.2R2-S1-EVO, 23.4 versions before 23.4R1-S2-EVO, 23.4R2-EVO.

An Uncontrolled Resource Consumption vulnerability in the http daemon (httpd) of Juniper Networks Junos OS on SRX Series, QFX Series, MX Series and EX Series allows an unauthenticated, network-based attacker to cause Denial-of-Service (DoS).

An attacker can send specific HTTPS connection requests to the device, triggering the creation of processes that are not properly terminated. Over time, this leads to resource exhaustion, ultimately causing the device to crash and restart.

The following command can be used to monitor the resource usage: user@host> show system processes extensive | match mgd | count

This issue affects Junos OS on SRX Series and EX Series: All versions before 21.4R3-S7, from 22.2 before 22.2R3-S4, from 22.3 before 22.3R3-S3, from 22.4 before 22.4R3-S2, from 23.2 before 23.2R2-S1, from 23.4 before 23.4R1-S2, 23.4R2.

A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in the AgentD process of Juniper Networks Junos OS allows an attacker who is already causing impact to established sessions which generates counter changes picked up by the AgentD process during telemetry polling, to move the AgentD process into a state where AgentD attempts to reap an already destroyed sensor. This reaping attempt then leads to memory corruption causing the FPC to crash which is a Denial of Service (DoS).

The FPC will recover automatically without user intervention after the crash. This issue affects Junos OS:

All versions before 21.4R3-S9 From 22.2 before 22.2R3-S5, From 22.3 before 22.3R3-S4, From 22.4 before 22.4R3-S3, From 23.2 before 23.2R2-S2, From 23.4 before 23.4R2.

This issue does not affect Junos OS Evolved.

A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of the Juniper Networks Junos OS on the MX Series platforms with Trio-based FPCs allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS).

In case of channelized Modular Interface Cards (MICs), every physical interface flap operation will leak heap memory. Over a period of time, continuous physical interface flap operations causes local FPC to eventually run out of memory and crash.

Below CLI command can be used to check the memory usage over a period of time:

user@host> show chassis fpc

Temp CPU Utilization (%)   CPU Utilization (%) Memory   Utilization (%)   Slot State     (C)  Total  Interrupt     1min   5min   15min DRAM (MB) Heap     Buffer

0 Online       43     41         2                           2048       49         14

1 Online       43     41         2                           2048       49         14

2 Online       43     41         2                           2048       49         14

This issue affects Junos OS on MX Series:

All versions before 21.2R3-S7,  from 21.4 before 21.4R3-S6,  from 22.1 before 22.1R3-S5,  from 22.2 before 22.2R3-S3,  from 22.3 before 22.3R3-S2,  from 22.4 before 22.4R3,  from 23.2 before 23.2R2,  from 23.4 before 23.4R2.

An Improper Handling of Exceptional Conditions vulnerability in the rpd-server of Juniper Networks Junos OS and Junos OS Evolved within cRPD allows an unauthenticated network-based attacker sending crafted TCP traffic to the routing engine (RE) to cause a CPU-based Denial of Service (DoS).

If specially crafted TCP traffic is received by the control plane, or a TCP session terminates unexpectedly, it will cause increased control plane CPU utilization by the rpd-server process.

While not explicitly required, the impact is more severe when RIB sharding is enabled.

Task accounting shows unexpected reads by the RPD Server jobs for shards:

user@junos> show task accounting detail ... read:RPD Server.0.0.0.0+780.192.168.0.78+48886 TOT:00000003.00379787 MAX:00000000.00080516 RUNS: 233888\ read:RPD Server.0.0.0.0+780.192.168.0.78+49144 TOT:00000004.00007565 MAX:00000000.00080360 RUNS: 233888\ read:RPD Server.0.0.0.0+780.192.168.0.78+49694 TOT:00000003.00600584 MAX:00000000.00080463 RUNS: 233888\ read:RPD Server.0.0.0.0+780.192.168.0.78+50246 TOT:00000004.00346998 MAX:00000000.00080338 RUNS: 233888\

This issue affects:

Junos OS with cRPD:

All versions before 21.2R3-S8,  21.4 before 21.4R3-S7,  22.1 before 22.1R3-S6,  22.2 before 22.2R3-S4,  22.3 before 22.3R3-S3,  22.4 before 22.4R3-S2,  23.2 before 23.2R2-S2,  24.2 before 24.2R2;

Junos OS Evolved with cRPD:

All versions before 21.4R3-S7-EVO,  22.2 before 22.2R3-S4-EVO,  22.3 before 22.3R3-S3-EVO,  22.4 before 22.4R3-S2-EVO,  23.2 before 23.2R2-EVO.

An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specific BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue only affects systems with BGP traceoptions enabled and

requires a BGP session to be already established.  Systems without BGP traceoptions enabled are not affected by this issue.

This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects:

Junos OS:

All versions before 21.2R3-S8,  from 21.4 before 21.4R3-S8,  from 22.2 before 22.2R3-S4,  from 22.3 before 22.3R3-S4, from 22.4 before 22.4R3-S3,  from 23.2 before 23.2R2-S1,  from 23.4 before 23.4R2;

Junos OS Evolved:

All versions before 21.2R3-S8-EVO,  from 21.4-EVO before 21.4R3-S8-EVO,  from 22.2-EVO before 22.2R3-S4-EVO,  from 22.3-EVO before 22.3R3-S4-EVO, from 22.4-EVO before 22.4R3-S3-EVO,  from 23.2-EVO before 23.2R2-S1-EVO,  from 23.4-EVO before 23.4R2-EVO.

An Out-of-Bounds Read vulnerability in

the routing protocol daemon (rpd) of

Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue only affects systems configured in either of two ways:

systems with BGP traceoptions enabled

systems with BGP traffic engineering configured

This issue can affect iBGP and eBGP with

any address family

configured. The specific attribute involved is non-transitive, and will not propagate across a network.

This issue affects:

Junos OS:

All versions before 21.4R3-S8, 22.2 before 22.2R3-S5,  22.3 before 22.3R3-S4,  22.4 before 22.4R3-S3,  23.2 before 23.2R2-S2,  23.4 before 23.4R2;

Junos OS Evolved:

All versions before 21.4R3-S8-EVO,  22.2-EVO before 22.2R3-S5-EVO,  22.3-EVO before 22.3R3-S4-EVO,  22.4-EVO before 22.4R3-S3-EVO,  23.2-EVO before 23.2R2-S2-EVO,  23.4-EVO before 23.4R2-EVO.

An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

In some cases, rpd fails to restart requiring a manual restart via the 'restart routing' CLI command.

This issue only affects systems with BGP traceoptions enabled and

requires a BGP session to be already established. Systems without BGP traceoptions enabled are not affected by this issue.

This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects:

Junos OS:

All versions before 21.4R3-S8,  22.2 before 22.2R3-S5,  22.3 before 22.3R3-S4,  22.4 before 22.4R3-S3,  23.2 before 23.2R2-S2,  23.4 before 23.4R2;

Junos OS Evolved:

All versions before 21.4R3-S8-EVO,  22.2-EVO before 22.2R3-S5-EVO,  22.3-EVO before 22.3R3-S4-EVO,  22.4-EVO before 22.4R3-S3-EVO,  23.2-EVO before 23.2R2-S2-EVO,  23.4-EVO before 23.4R2-EVO.

An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a network based, unauthenticated attacker to cause the RPD process to crash leading to a Denial of Service (DoS).

When a malformed BGP UPDATE packet is received over an established BGP session, RPD crashes and restarts.

Continuous receipt of the malformed BGP UPDATE messages will create a sustained Denial of Service (DoS) condition for impacted devices.

This issue affects eBGP and iBGP, in both IPv4 and IPv6 implementations. This issue requires a remote attacker to have at least one established BGP session.

This issue affects: Juniper Networks Junos OS: All versions earlier than 20.4R3-S9; 21.2 versions earlier than 21.2R3-S7; 21.3 versions earlier than 21.3R3-S5; 21.4 versions earlier than 21.4R3-S6; 22.1 versions earlier than 22.1R3-S4; 22.2 versions earlier than 22.2R3-S3; 22.3 versions earlier than 22.3R3-S2; 22.4 versions earlier than 22.4R3; 23.2 versions earlier than 23.2R2.

Juniper Networks Junos OS Evolved: All versions earlier than 21.2R3-S7; 21.3-EVO versions earlier than 21.3R3-S5; 21.4-EVO versions earlier than 21.4R3-S8; 22.1-EVO versions earlier than 22.1R3-S4; 22.2-EVO versions earlier than 22.2R3-S3; 22.3-EVO versions earlier than 22.3R3-S2; 22.4-EVO versions earlier than 22.4R3; 23.2-EVO versions earlier than 23.2R2.

An Uncontrolled Resource Consumption vulnerability in the H.323 ALG (Application Layer Gateway) of  Juniper Networks Junos OS on SRX Series and MX Series with SPC3 and MS-MPC/MIC, allows an unauthenticated network-based attacker to send specific packets causing traffic loss leading to Denial of Service (DoS).

Continued receipt and processing of these specific packets will sustain the Denial of Service condition.

The memory usage can be monitored using the below command.

user@host> show usp memory segment sha data objcache jsf  This issue affects SRX Series and MX Series with SPC3 and MS-MPC/MIC:

20.4 before 20.4R3-S10,   21.2 before 21.2R3-S6,   21.3 before 21.3R3-S5,   21.4 before 21.4R3-S6,   22.1 before 22.1R3-S4,   22.2 before 22.2R3-S2,   22.3 before 22.3R3-S1,   22.4 before 22.4R3,   23.2 before 23.2R2.

A Missing Release of Memory after Effective Lifetime vulnerability in the routing process daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to send a malformed BGP Path attribute update which allocates memory used to log the bad path attribute. This memory is not properly freed in all circumstances, leading to a Denial of Service (DoS).

Consumed memory can be freed by manually restarting Routing Protocol Daemon (rpd).

Memory utilization could be monitored by:  user@host> show system memory or show system monitor memory status

This issue affects:

Junos OS:  All versions before 21.2R3-S8,  from 21.4 before 21.4R3-S8,

from 22.2 before 22.2R3-S4,  from 22.3 before 22.3R3-S3,  from 22.4 before 22.4R3-S3, from 23.2 before 23.2R2-S1,  from 23.4 before 23.4R1-S2, 23.4R2.

Junos OS Evolved: All versions before 21.2R3-S8-EVO, from 21.4 before 21.4R3-S8-EVO, from 22.2 before 22.2R3-S4-EVO, from 22.3 before 22.3R3-S3-EVO, from 22.4 before 22.4R3-S3-EVO,

from 23.2 before 23.2R2-S1-EVO, from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the the IKE daemon (iked) of Juniper Networks Junos OS on SRX Series, MX Series with SPC3 and NFX350 allows allows an unauthenticated, network-based attacker sending specific mismatching parameters as part of the IPsec negotiation to trigger an iked crash leading to Denial of Service (DoS).

This issue is applicable to all platforms that run iked. This issue affects Junos OS on SRX Series, MX Series with SPC3 and NFX350:

All versions before 21.2R3-S8,  from 21.4 before 21.4R3-S7,  from 22.1 before 22.1R3-S2,  from 22.2 before 22.2R3-S1,  from 22.3 before 22.3R2-S1, 22.3R3,  from 22.4 before 22.4R1-S2, 22.4R2, 22.4R3.

A Buffer Copy without Checking Size of Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated, adjacent attacker to send specific RPKI-RTR packets resulting in a crash, creating a Denial of Service (DoS) condition. Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue affects

Junos OS:

All versions before 21.2R3-S8,  from 21.4 before 21.4R3-S8, from 22.2 before 22.2R3-S4,  from 22.3 before 22.3R3-S3,  from 22.4 before 22.4R3-S2,  from 23.2 before 23.2R2-S1,  from 23.4 before 23.4R2.

Junos OS Evolved: All versions before 21.2R3-S8-EVO, from 21.4 before 21.4R3-S8-EVO, from 22.2 before 22.2R3-S4-EVO,  from 22.3 before 22.3R3-S3-EVO, from 22.4 before 22.4R3-S2-EVO,  from 23.2 before 23.2R2-S1-EVO, from 23.4 before 23.4R2-EVO.

A Use of Externally-Controlled Format String vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

If DNS Domain Generation Algorithm (DGA) detection or tunnel detection, and DNS-filtering traceoptions are configured, and specific valid transit DNS traffic is received this causes a PFE crash and restart, leading to a Denial of Service.

This issue affects Junos OS: All versions before 21.4R3-S6, 22.2 versions before 22.2R3-S3, 22.3 versions before 22.3R3-S3, 22.4 versions before 22.4R3, 23.2 versions before 23.2R2.

An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system.

The Junos OS Evolved CLI doesn't properly handle command options in some cases, allowing users which execute specific CLI commands with a crafted set of parameters to escalate their privileges to root on shell level.

This issue affects Junos OS Evolved:

All versions before 20.4R3-S7-EVO,

21.2-EVO versions before 21.2R3-S8-EVO,

21.4-EVO versions before 21.4R3-S7-EVO,

22.2-EVO versions before 22.2R3-EVO,

22.3-EVO versions before 22.3R2-EVO,

22.4-EVO versions before 22.4R2-EVO.

An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system.

The Junos OS Evolved CLI doesn't properly handle command options in some cases, allowing users which execute specific CLI commands with a crafted set of parameters to escalate their privileges to root on shell level.

This issue affects Junos OS Evolved:

All versions before 20.4R3-S7-EVO, 21.2-EVO versions before 21.2R3-S8-EVO, 21.4-EVO versions before 21.4R3-S7-EVO, 22.1-EVO versions before 22.1R3-S6-EVO,  22.2-EVO versions before 22.2R3-EVO, 22.3-EVO versions before 22.3R2-EVO, 22.4-EVO versions before 22.4R2-EVO.

An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system.

The Junos OS Evolved CLI doesn't properly handle command options in some cases, allowing users which execute specific CLI commands with a crafted set of parameters to escalate their privileges to root on shell level.

This issue affects Junos OS Evolved:

22.3-EVO versions before 22.3R2-EVO, 22.4-EVO versions before 22.4R1-S1-EVO, 22.4R2-EVO.

An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system.

The Junos OS Evolved CLI doesn't properly handle command options in some cases, allowing users which execute specific CLI commands with a crafted set of parameters to escalate their privileges to root on shell level.

This issue affects Junos OS Evolved:

21.1-EVO versions 21.1R1-EVO and later before 21.2R3-S8-EVO,  21.4-EVO versions before 21.4R3-S7-EVO, 22.1-EVO versions before 22.1R3-S6-EVO,  22.2-EVO versions before 22.2R3-EVO, 22.3-EVO versions before 22.3R2-EVO.