An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or conductor running with a redundant peer allows a network based attacker to bypass authentication and take full control of the device. Only routers or conductors that are running in high-availability redundant configurations are affected by this vulnerability.

No other Juniper Networks products or platforms are affected by this issue.

This issue affects:

Session Smart Router:

All versions before 5.6.15,  from 6.0 before 6.1.9-lts,  from 6.2 before 6.2.5-sts.

Session Smart Conductor:

All versions before 5.6.15,  from 6.0 before 6.1.9-lts,  from 6.2 before 6.2.5-sts.

WAN Assurance Router:

6.0 versions before 6.1.9-lts,  6.2 versions before 6.2.5-sts.

An Out-of-bounds Write vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS), or Remote Code Execution (RCE) and obtain root privileges on the device.

This issue is caused by use of an insecure function allowing an attacker to overwrite arbitrary memory.

This issue affects Juniper Networks Junos OS SRX Series and EX Series:

Junos OS versions earlier than 20.4R3-S9; Junos OS 21.2 versions earlier than 21.2R3-S7; Junos OS 21.3 versions earlier than 21.3R3-S5; Junos OS 21.4 versions earlier than 21.4R3-S5; Junos OS 22.1 versions earlier than 22.1R3-S4; Junos OS 22.2 versions earlier than 22.2R3-S3; Junos OS 22.3 versions earlier than 22.3R3-S2; Junos OS 22.4 versions earlier than 22.4R2-S2, 22.4R3.

An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may allows a network-based attacker to bypass authentication and take administrative control of the device.

This issue affects Session Smart Router:

from 5.6.7 before 5.6.17,  from 6.0 before 6.0.8 (affected from 6.0.8),

from 6.1 before 6.1.12-lts,  from 6.2 before 6.2.8-lts,  from 6.3 before 6.3.3-r2;

This issue affects Session Smart Conductor:

from 5.6.7 before 5.6.17,  from 6.0 before 6.0.8 (affected from 6.0.8),

from 6.1 before 6.1.12-lts,  from 6.2 before 6.2.8-lts,  from 6.3 before 6.3.3-r2;

This issue affects WAN Assurance Managed Routers:

from 5.6.7 before 5.6.17,  from 6.0 before 6.0.8 (affected from 6.0.8),

from 6.1 before 6.1.12-lts,  from 6.2 before 6.2.8-lts,  from 6.3 before 6.3.3-r2.

An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to execute code as root.

The On-Box Anomaly detection framework should only be reachable by other internal processes over the internal routing instance, but not over an externally exposed port. With the ability to access and manipulate the service to execute code as root a remote attacker can take complete control of the device. Please note that this service is enabled by default as no specific configuration is required.

This issue affects Junos OS Evolved on PTX Series:

25.4 versions before 25.4R1-S1-EVO, 25.4R2-EVO.

This issue does not affect Junos OS Evolved versions before 25.4R1-EVO.

This issue does not affect Junos OS.

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series

and SRX Series

allows an unauthenticated, network-based attacker to remotely execute code.

Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.

This issue affects Juniper Networks Junos OS on EX Series

and

SRX Series:

All versions prior to

20.4R3-S9; 21.1 versions 21.1R1 and later; 21.2 versions prior to 21.2R3-S7; 21.3 versions prior to 21.3R3-S5; 21.4 versions prior to 21.4R3-S5; 22.1 versions

prior to

22.1R3-S4; 22.2 versions

prior to

22.2R3-S2; 22.3 versions

prior to

22.3R2-S2, 22.3R3-S1; 22.4 versions

prior to

22.4R2-S1, 22.4R3; 23.2 versions prior to 23.2R1-S1, 23.2R2.

A Missing Authorization vulnerability in Juniper Networks Security Director allows an unauthenticated network-based attacker to read or tamper with multiple sensitive resources via the web interface.

Numerous endpoints on the Juniper Security Director appliance do not validate authorization and will deliver information to the caller that is outside their authorization level. An attacker can access data that is outside the user's authorization level. The information obtained can be used to gain access to additional information or perpetrate other attacks, impacting downstream managed devices.

This issue affects Security Director version 24.4.1.

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to store script tags directly in web pages that, when viewed by another user, enable the attacker to execute commands with the target's administrative permissions. This issue affects all versions of Junos Space before 24.1R4.

A Use of Default Password vulnerability in the Juniper Networks

Support Insights (JSI)

Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device.

vLWC software images ship with an initial password for a high privileged account. A change of this password is not enforced during the provisioning of the software, which can make full access to the system by unauthorized actors possible.This issue affects all versions of vLWC before 3.0.94.

The Use of a Hard-coded Cryptographic Key vulnerability in Juniper Networks Juniper Cloud Native Router (JCNR) and containerized routing Protocol Deamon (cRPD) products allows an attacker to perform Person-in-the-Middle (PitM) attacks which results in complete compromise of the container.

Due to hardcoded SSH host keys being present on the container, a PitM attacker can intercept SSH traffic without being detected.

This issue affects Juniper Networks JCNR: All versions before 23.4.

This issue affects Juniper Networks cRPD: All versions before 23.4R1.

A Weak Password Requirements vulnerability in the password management function of Juniper Networks CTP OS might allow an unauthenticated, network-based attacker to exploit weak passwords of local accounts and potentially take full control of the device.

The password management menu enables the administrator to set password complexity requirements, but these settings are not saved. The issue can be verified with the menu option "Show password requirements". Failure to enforce the intended requirements can lead to weak passwords being used, which significantly increases the likelihood that an attacker can guess these and subsequently attain unauthorized access.

This issue affects CTP OS versions 9.2R1 and 9.2R2.

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an attacker to construct a URL that when visited by another user enables the attacker to execute commands with the target's permissions, including an administrator.

A specific invocation of the emitdebugnote method in webauthoperation.php will echo back the data it receives.

This issue affects Juniper Networks Junos OS on SRX Series and EX Series: All versions earlier than 20.4R3-S10; 21.2 versions earlier than 21.2R3-S8; 21.4 versions earlier than 21.4R3-S6; 22.1 versions earlier than 22.1R3-S5; 22.2 versions earlier than 22.2R3-S3; 22.3 versions earlier than 22.3R3-S2; 22.4 versions earlier than 22.4R3-S1; 23.2 versions earlier than 23.2R2; 23.4 versions earlier than 23.4R2.

An Improper Validation of Syntactic Correctness of Input vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS).

If a BGP update is received over an established BGP session which contains a tunnel encapsulation attribute with a specifically malformed TLV, rpd will crash and restart.

This issue affects Juniper Networks Junos OS: 20.4 versions 20.4R1 and later versions earlier than 20.4R3-S9; 21.2 versions earlier than 21.2R3-S7; 21.3 versions earlier than 21.3R3-S5; 21.4 versions earlier than 21.4R3-S5; 22.1 versions earlier than 22.1R3-S4; 22.2 versions earlier than 22.2R3-S3; 22.3 versions earlier than 22.3R3-S1; 22.4 versions earlier than 22.4R3; 23.2 versions earlier than 23.2R1-S2, 23.2R2;

Junos OS Evolved: 20.4-EVO versions 20.4R1-EVO and later versions earlier than 20.4R3-S9-EVO; 21.2-EVO versions earlier than 21.2R3-S7-EVO; 21.3-EVO versions earlier than 21.3R3-S5-EVO; 21.4-EVO versions earlier than 21.4R3-S5-EVO; 22.1-EVO versions earlier than 22.1R3-S4-EVO; 22.2-EVO versions earlier than 22.2R3-S3-EVO; 22.3-EVO versions earlier than 22.3R3-S1-EVO; 22.4-EVO versions earlier than 22.4R3-EVO; 23.2-EVO versions earlier than 23.2R1-S2-EVO, 23.2R2-EVO;

This issue does not affect Juniper Networks Junos OS versions earlier than 20.4R1; Junos OS Evolved versions earlier than 20.4R1-EVO.

This is a related but separate issue than the one described in JSA79095.

An Incorrect Calculation of Buffer Size vulnerability in Juniper Networks Junos OS SRX 5000 Series devices using SPC2 line cards while ALGs are enabled allows an attacker sending specific crafted packets to cause a transit traffic Denial of Service (DoS).

Continued receipt and processing of these specific packets will sustain the Denial of Service condition.

This issue affects: Juniper Networks Junos OS SRX 5000 Series with SPC2 with ALGs enabled. All versions earlier than 21.2R3-S7; 21.4 versions earlier than 21.4R3-S6; 22.1 versions earlier than 22.1R3-S5; 22.2 versions earlier than 22.2R3-S3; 22.3 versions earlier than 22.3R3-S2; 22.4 versions earlier than 22.4R3; 23.2 versions earlier than 23.2R2.

A Stack-based Buffer Overflow vulnerability in Flow Processing Daemon (flowd) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service (DoS).

On all Junos OS MX Series platforms with SPC3 and MS-MPC/-MIC, when URL filtering is enabled and a specific URL request is received and processed, flowd will crash and restart. Continuous reception of the specific URL request will lead to a sustained Denial of Service (DoS) condition.

This issue affects: Junos OS:

all versions before 21.2R3-S6,

from 21.3 before 21.3R3-S5,

from 21.4 before 21.4R3-S5,

from 22.1 before 22.1R3-S3,

from 22.2 before 22.2R3-S1,

from 22.3 before 22.3R2-S2, 22.3R3,

from 22.4 before 22.4R2-S1, 22.4R3.

An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based, unauthenticated attacker to send a specific routing update, causing an rpd core due to memory corruption, leading to a Denial of Service (DoS).

This issue can only be triggered when the system is configured for CoS-based forwarding (CBF) with a policy map containing a cos-next-hop-map action (see below). This issue affects: Junos OS:

all versions before 20.4R3-S10, from 21.2 before 21.2R3-S8, from 21.3 before 21.3R3, from 21.4 before 21.4R3, from 22.1 before 22.1R2;

Junos OS Evolved:

all versions before 21.2R3-S8-EVO, from 21.3 before 21.3R3-EVO, from 21.4 before 21.4R3-EVO, from 22.1 before 22.1R2-EVO.

An Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).

When a high amount of specific traffic is received on a SRX4600 device, due to an error in internal packet handling, a consistent rise in CPU memory utilization occurs. This results in packet drops in the traffic and eventually the PFE crashes. A manual reboot of the PFE will be required to restore the device to original state.

This issue affects Junos OS:

21.2 before 21.2R3-S7, 21.4 before 21.4R3-S6,  22.1 before 22.1R3-S5, 22.2 before 22.2R3-S3, 22.3 before 22.3R3-S2, 22.4 before 22.4R3,

23.2 before 23.2R1-S2, 23.2R2.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the the Public Key Infrastructure daemon (pkid) of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause Denial of Service (DoS).

The pkid is responsible for the certificate verification. Upon a failed verification, the pkid uses all CPU resources and becomes unresponsive to future verification attempts. This means that all subsequent VPN negotiations depending on certificate verification will fail.

This CPU utilization of pkid can be checked using this command:   root@srx> show system processes extensive | match pkid   xxxxx  root  103  0  846M  136M  CPU1  1 569:00 100.00% pkid

This issue affects: Juniper Networks Junos OS All versions prior to 20.4R3-S10; 21.2 versions prior to 21.2R3-S7; 21.4 versions prior to 21.4R3-S5; 22.1 versions prior to 22.1R3-S4; 22.2 versions prior to 22.2R3-S3; 22.3 versions prior to 22.3R3-S1; 22.4 versions prior to 22.4R3; 23.2 versions prior to 23.2R1-S2, 23.2R2.

An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specific malformed BGP update message to cause the session to reset, resulting in a Denial of Service (DoS). Continued receipt and processing of these malformed BGP update messages will create a sustained Denial of Service (DoS) condition.

Upon receipt of a BGP update message over an established BGP session containing a specifically malformed tunnel encapsulation attribute, when segment routing is enabled, internal processing of the malformed attributes within the update results in improper parsing of remaining attributes, leading to session reset:

BGP SEND Notification code 3 (Update Message Error) subcode 1 (invalid attribute list)

Only systems with segment routing enabled are vulnerable to this issue.

This issue affects eBGP and iBGP, in both IPv4 and IPv6 implementations, and requires a remote attacker to have at least one established BGP session.

This issue affects:

Junos OS:

All versions before 21.4R3-S8, from 22.2 before 22.2R3-S4, from 22.3 before 22.3R3-S3, from 22.4 before 22.4R3-S3, from 23.2 before 23.2R2-S1, from 23.4 before 23.4R1-S2, 23.4R2.

Junos OS Evolved:

All versions before 21.4R3-S8-EVO, from 22.2-EVO before 22.2R3-S4-EVO, from 22.3-EVO before 22.3R3-S3-EVO, from 22.4-EVO before 22.4R3-S3-EVO, from 23.2-EVO before 23.2R2-S1-EVO, from 23.4-EVO before 23.4R1-S2-EVO, 23.4R2-EVO.

A Missing Release of Resource after Effective Lifetime vulnerability the xinetd process, responsible for spawning SSH daemon (sshd) instances, of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to cause a Denial of Service (DoS) by blocking SSH access for legitimate users. Continued receipt of these connections will create a sustained Denial of Service (DoS) condition.

The issue is triggered when a high rate of concurrent SSH requests are received and terminated in a specific way, causing xinetd to crash, and leaving defunct sshd processes. Successful exploitation of this vulnerability blocks both SSH access as well as services which rely upon SSH, such as SFTP, and Netconf over SSH.

Once the system is in this state, legitimate users will be unable to SSH to the device until service is manually restored.  See WORKAROUND section below.

Administrators can monitor an increase in defunct sshd processes by utilizing the CLI command:

> show system processes | match sshd   root   25219 30901 0 Jul16 ?       00:00:00 [sshd] <defunct>

This issue affects Juniper Networks Junos OS Evolved: All versions prior to 21.4R3-S7-EVO 22.3-EVO versions prior to 22.3R2-S2-EVO, 22.3R3-S2-EVO; 22.4-EVO versions prior to 22.4R3-EVO; 23.2-EVO versions prior to 23.2R2-EVO.

This issue does not affect Juniper Networks Junos OS Evolved 22.1-EVO nor 22.2-EVO.

A Heap-based Buffer Overflow vulnerability in the telemetry sensor process (sensord) of Juniper Networks Junos OS on MX240, MX480, MX960 platforms using MPC10E causes a steady increase in memory utilization, ultimately leading to a Denial of Service (DoS).

When the device is subscribed to a specific subscription on Junos Telemetry Interface, a slow memory leak occurs and eventually all resources are consumed and the device becomes unresponsive. A manual reboot of the Line Card will be required to restore the device to its normal functioning.

This issue is only seen when telemetry subscription is active.

The Heap memory utilization can be monitored using the following command:   > show system processes extensive

The following command can be used to monitor the memory utilization of the specific sensor   > show system info | match sensord PID NAME MEMORY PEAK MEMORY %CPU THREAD-COUNT CORE-AFFINITY UPTIME

1986 sensord 877.57MB 877.57MB 2 4 0,2-15 7-21:41:32

This issue affects Junos OS:

from 21.2R3-S5 before 21.2R3-S7,  from 21.4R3-S4 before 21.4R3-S6,  from 22.2R3 before 22.2R3-S4,  from 22.3R2 before 22.3R3-S2,  from 22.4R1 before 22.4R3,  from 23.2R1 before 23.2R2.

An Improper Handling of Values vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX 7000 Series allows a network-based, unauthenticated attacker to cause a Denial-of-Service (DoS).

If a value is configured for DDoS bandwidth or burst parameters for any protocol in a queue, all protocols which share the same queue will have their bandwidth or burst value changed to the new value. If, for example, OSPF was configured with a certain bandwidth value, ISIS would also be limited to this value. So inadvertently either the control plane is open for a high level of specific traffic which was supposed to be limited to a lower value, or the limit for a certain protocol is so low that chances to succeed with a volumetric DoS attack are significantly increased.

This issue affects Junos OS Evolved on ACX 7000 Series:

All versions before 21.4R3-S7-EVO, 22.1 versions before 22.1R3-S6-EVO,  22.2 versions before 22.2R3-S3-EVO, 22.3 versions before 22.3R3-S3-EVO,  22.4 versions before 22.4R3-S2-EVO, 23.2 versions before 23.2R2-EVO, 23.4

versions

before 23.4R1-S1-EVO, 23.4R2-EVO.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on SRX Series, and MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

When an affected device receives specific valid TCP traffic, the pfe crashes and restarts leading to a momentary but complete service outage.

This issue affects Junos OS:

21.2 releases from 21.2R3-S5 before 21.2R3-S6.

This issue does not affect earlier or later releases.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the the IKE daemon (iked) of Juniper Networks Junos OS on SRX Series, MX Series with SPC3 and NFX350 allows allows an unauthenticated, network-based attacker sending specific mismatching parameters as part of the IPsec negotiation to trigger an iked crash leading to Denial of Service (DoS).

This issue is applicable to all platforms that run iked. This issue affects Junos OS on SRX Series, MX Series with SPC3 and NFX350:

All versions before 21.2R3-S8,  from 21.4 before 21.4R3-S7,  from 22.1 before 22.1R3-S2,  from 22.2 before 22.2R3-S1,  from 22.3 before 22.3R2-S1, 22.3R3,  from 22.4 before 22.4R1-S2, 22.4R2, 22.4R3.

An Improper Validation of Syntactic Correctness of Input vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with MPC10/11 or LC9600, MX304, and Junos OS Evolved on ACX Series and PTX Series allows an unauthenticated, network based attacker to cause a Denial-of-Service (DoS).

This issue can occur in two scenarios:

1. If a device, which is configured with SFLOW and ECMP, receives specific valid transit traffic, which is subject to sampling, the packetio process crashes, which in turn leads to an evo-aftman crash and causes the FPC to stop working until it is restarted. (This scenario is only applicable to PTX but not to ACX or MX.)

2. If a device receives a malformed CFM packet on an interface configured with CFM, the packetio process crashes, which in turn leads to an evo-aftman crash and causes the FPC to stop working until it is restarted. Please note that the CVSS score is for the formally more severe issue 1.

The CVSS score for scenario 2. is: 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

This issue affects Junos OS:

All versions before 21.2R3-S4, 21.4 versions before 21.4R2, 22.2 versions before 22.2R3-S2;

Junos OS Evolved:

All versions before 21.2R3-S8-EVO, 21.4 versions before 21.4R2-EVO.

An Uncontrolled Resource Consumption vulnerability in the H.323 ALG (Application Layer Gateway) of  Juniper Networks Junos OS on SRX Series and MX Series with SPC3 and MS-MPC/MIC, allows an unauthenticated network-based attacker to send specific packets causing traffic loss leading to Denial of Service (DoS).

Continued receipt and processing of these specific packets will sustain the Denial of Service condition.

The memory usage can be monitored using the below command.

user@host> show usp memory segment sha data objcache jsf  This issue affects SRX Series and MX Series with SPC3 and MS-MPC/MIC:

20.4 before 20.4R3-S10,   21.2 before 21.2R3-S6,   21.3 before 21.3R3-S5,   21.4 before 21.4R3-S6,   22.1 before 22.1R3-S4,   22.2 before 22.2R3-S2,   22.3 before 22.3R3-S1,   22.4 before 22.4R3,   23.2 before 23.2R2.

An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a network based, unauthenticated attacker to cause the RPD process to crash leading to a Denial of Service (DoS).

When a malformed BGP UPDATE packet is received over an established BGP session, RPD crashes and restarts.

Continuous receipt of the malformed BGP UPDATE messages will create a sustained Denial of Service (DoS) condition for impacted devices.

This issue affects eBGP and iBGP, in both IPv4 and IPv6 implementations. This issue requires a remote attacker to have at least one established BGP session.

This issue affects: Juniper Networks Junos OS: All versions earlier than 20.4R3-S9; 21.2 versions earlier than 21.2R3-S7; 21.3 versions earlier than 21.3R3-S5; 21.4 versions earlier than 21.4R3-S6; 22.1 versions earlier than 22.1R3-S4; 22.2 versions earlier than 22.2R3-S3; 22.3 versions earlier than 22.3R3-S2; 22.4 versions earlier than 22.4R3; 23.2 versions earlier than 23.2R2.

Juniper Networks Junos OS Evolved: All versions earlier than 21.2R3-S7; 21.3-EVO versions earlier than 21.3R3-S5; 21.4-EVO versions earlier than 21.4R3-S8; 22.1-EVO versions earlier than 22.1R3-S4; 22.2-EVO versions earlier than 22.2R3-S3; 22.3-EVO versions earlier than 22.3R3-S2; 22.4-EVO versions earlier than 22.4R3; 23.2-EVO versions earlier than 23.2R2.

An Out-of-Bounds Read vulnerability in

the routing protocol daemon (rpd) of

Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue only affects systems configured in either of two ways:

systems with BGP traceoptions enabled

systems with BGP traffic engineering configured

This issue can affect iBGP and eBGP with

any address family

configured. The specific attribute involved is non-transitive, and will not propagate across a network.

This issue affects:

Junos OS:

All versions before 21.4R3-S8, 22.2 before 22.2R3-S5,  22.3 before 22.3R3-S4,  22.4 before 22.4R3-S3,  23.2 before 23.2R2-S2,  23.4 before 23.4R2;

Junos OS Evolved:

All versions before 21.4R3-S8-EVO,  22.2-EVO before 22.2R3-S5-EVO,  22.3-EVO before 22.3R3-S4-EVO,  22.4-EVO before 22.4R3-S3-EVO,  23.2-EVO before 23.2R2-S2-EVO,  23.4-EVO before 23.4R2-EVO.

An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specific BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue only affects systems with BGP traceoptions enabled and

requires a BGP session to be already established.  Systems without BGP traceoptions enabled are not affected by this issue.

This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects:

Junos OS:

All versions before 21.2R3-S8,  from 21.4 before 21.4R3-S8,  from 22.2 before 22.2R3-S4,  from 22.3 before 22.3R3-S4, from 22.4 before 22.4R3-S3,  from 23.2 before 23.2R2-S1,  from 23.4 before 23.4R2;

Junos OS Evolved:

All versions before 21.2R3-S8-EVO,  from 21.4-EVO before 21.4R3-S8-EVO,  from 22.2-EVO before 22.2R3-S4-EVO,  from 22.3-EVO before 22.3R3-S4-EVO, from 22.4-EVO before 22.4R3-S3-EVO,  from 23.2-EVO before 23.2R2-S1-EVO,  from 23.4-EVO before 23.4R2-EVO.

An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

In some cases, rpd fails to restart requiring a manual restart via the 'restart routing' CLI command.

This issue only affects systems with BGP traceoptions enabled and

requires a BGP session to be already established. Systems without BGP traceoptions enabled are not affected by this issue.

This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects:

Junos OS:

All versions before 21.4R3-S8,  22.2 before 22.2R3-S5,  22.3 before 22.3R3-S4,  22.4 before 22.4R3-S3,  23.2 before 23.2R2-S2,  23.4 before 23.4R2;

Junos OS Evolved:

All versions before 21.4R3-S8-EVO,  22.2-EVO before 22.2R3-S5-EVO,  22.3-EVO before 22.3R3-S4-EVO,  22.4-EVO before 22.4R3-S3-EVO,  23.2-EVO before 23.2R2-S2-EVO,  23.4-EVO before 23.4R2-EVO.

An Improper Handling of Exceptional Conditions vulnerability in the rpd-server of Juniper Networks Junos OS and Junos OS Evolved within cRPD allows an unauthenticated network-based attacker sending crafted TCP traffic to the routing engine (RE) to cause a CPU-based Denial of Service (DoS).

If specially crafted TCP traffic is received by the control plane, or a TCP session terminates unexpectedly, it will cause increased control plane CPU utilization by the rpd-server process.

While not explicitly required, the impact is more severe when RIB sharding is enabled.

Task accounting shows unexpected reads by the RPD Server jobs for shards:

user@junos> show task accounting detail ... read:RPD Server.0.0.0.0+780.192.168.0.78+48886 TOT:00000003.00379787 MAX:00000000.00080516 RUNS: 233888\ read:RPD Server.0.0.0.0+780.192.168.0.78+49144 TOT:00000004.00007565 MAX:00000000.00080360 RUNS: 233888\ read:RPD Server.0.0.0.0+780.192.168.0.78+49694 TOT:00000003.00600584 MAX:00000000.00080463 RUNS: 233888\ read:RPD Server.0.0.0.0+780.192.168.0.78+50246 TOT:00000004.00346998 MAX:00000000.00080338 RUNS: 233888\

This issue affects:

Junos OS with cRPD:

All versions before 21.2R3-S8,  21.4 before 21.4R3-S7,  22.1 before 22.1R3-S6,  22.2 before 22.2R3-S4,  22.3 before 22.3R3-S3,  22.4 before 22.4R3-S2,  23.2 before 23.2R2-S2,  24.2 before 24.2R2;

Junos OS Evolved with cRPD:

All versions before 21.4R3-S7-EVO,  22.2 before 22.2R3-S4-EVO,  22.3 before 22.3R3-S3-EVO,  22.4 before 22.4R3-S2-EVO,  23.2 before 23.2R2-EVO.