Junos OS vulnerabilities

A vulnerability in the Web-Filtering module of Junos OS on SRX Series allows an unauthenticated network-based attacker to cause a Denial-of-Service (DoS). A specially crafted SSL packet causes an FPC crash and restart.

A vulnerability in Juniper Junos OS on EX4000 models with 48 ports (EX4000-48T, EX4000-48P, EX4000-48MP) allows an unauthenticated network-based attacker to cause an FXPC crash and restart by sending a high volume of traffic to the device. This leads to a complete service outage until the device automatically restarts.

A vulnerability in Junos OS on SRX and MX devices with MX-SPC3 or MS-MPC service cards causes an infinite loop in the flow management process (flowd or mspmand) after receiving specific SIP messages over TCP. An unauthenticated attacker can send multiple such messages, leading to watchdog timer expiration and process crash, resulting in a Denial of Service (DoS). The issue only occurs over TCP, not UDP.

A Buffer Over-read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When an affected device receives a BGP update with a set of specific optional transitive attributes over an established peering session, rpd will crash and restart when attempting to advertise the received information to another peer.

A vulnerability in the DHCP service (jdhcpd) of Junos OS and Junos OS Evolved allows a DHCP client in one subnet to exhaust the address pools of other subnets, leading to a Denial of Service (DoS) on the downstream DHCP server. The issue arises from improper handling of DHCP DISCOVER packets with Option 82 in 'forward-only' mode, which are forwarded unmodified instead of being dropped, consuming addresses from the pool.

A vulnerability in Junos OS allows unauthorized access to the operating system through certain combinations of CLI commands. Users with the appropriate permissions can achieve elevated privileges and gain complete control of the device.

An internal Junos OS sockets library is vulnerable to a buffer overflow, which may lead to a denial of service (kernel panic) or privilege escalation through local code execution. The routines are only accessible via programs running on the device.

On Juniper Networks products or platforms running Junos OS versions prior to 12.1X46-D50, 12.1X47-D40, 12.3R13, 12.3X48-D30, 13.2X51-D40, 13.3R10, 14.1R8, 14.1X53-D35, 14.1X55-D35, 14.2R5, 15.1F6, 15.1R3, 15.1X49-D30, 15.1X49-D40, 15.1X53-D35, where RIP is enabled, certain RIP advertisements may cause the RPD daemon to crash, resulting in a denial of service condition.

On Juniper Networks products running Junos OS versions prior to 12.1X46-D55, 12.1X47-D45, 12.3R13, 12.3X48-D35, 13.3R10, 14.1R8, 14.1X53-D40, 14.1X55-D35, 14.2R6, 15.1F2 or 15.1R1, where the BGP add-path feature is enabled with 'send' option or with both 'send' and 'receive' options, a network-based attacker can cause the rpd daemon to crash and restart. Repeated crashes of the rpd daemon can result in an extended denial of service condition.

On Juniper Networks products running Junos OS versions prior to 11.4R13-S3, 12.1X46-D60, 12.3R12-S2, 13.2X51-D40, 13.3R10, 14.1R8, 14.1X53-D12, 14.1X55-D35, 14.2R7, 15.1F6, 15.1R3, 15.1X49-D60, and 15.1X53-D30, when DHCPv6 is enabled, receiving a crafted DHCPv6 packet causes the jdhcpd daemon to crash and restart. Repeated crashes of the jdhcpd process may lead to an extended denial of service condition for subscribers attempting to obtain IPv6 addresses.

Juniper Networks devices running affected versions of Junos OS may be vulnerable to a crafted BGP UPDATE which can lead to a crash and restart of the routing process daemon (rpd). Repeated crashes of the rpd daemon can result in an extended denial of service condition.

Junos OS versions before 12.1X46-D45, 12.1X46-D50, 12.1X47 before 12.1X47-D35, 12.3X48 before 12.3X48-D30, 13.3 before 13.3R9-S1, 14.1 before 14.1R7, 14.2 before 14.2R6, 15.1 before 15.1F2-S5, 15.1F4 before 15.1F4-S2, 15.1R before 15.1R2-S3, 15.1 before 15.1R3, and 15.1X49 before 15.1X49-D40 allow remote attackers to cause a denial of service (kernel crash) via a crafted UDP packet destined to the interface IP address of a 64-bit OS device.

Juniper's Junos OS before versions 12.1X44-D60, 12.1X46-D40, 12.1X47-D30, 12.3R11, 12.3X48-D20, 13.2R9, 13.2X51-D39, 13.3R8, 14.1R6, 14.1X53-D30, 14.2R4-S1, 15.1R2, 15.1X49-D30, and 16.1R1 is vulnerable to a denial of service (DoS) attack caused by crafted TCP timestamps. Attackers can exploit this vulnerability to exhaust socket resources.

A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreachable. A specifically formatted URL request is forwarded despite the system being configured to block it.

An Improper Handling of Undefined Parameters vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on EX Series devices allows an authenticated attacker with low privileges to cause a Denial-of-Service (DoS) by subscribing to an unsupported telemetry sensor path via gRPC, leading to an FPC crash and service outage until automatic restart.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on MX Series allows adjacent subscribers to bypass configured firewall filters.

A race condition vulnerability in the packet forwarding engine (PFE) of Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). The flaw affects flow timeout handling, leading to session accumulation and potential system crash or reboot.

A missing release of memory after effective lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on EX4100 and EX4400 switches allows an unauthenticated adjacent attacker to cause an FPC crash and restart. The issue occurs when sFlow is configured in a Virtual Chassis scenario and multicast traffic is forwarded between VC members.

The SIP plugin in Junos OS on MX Series with SPC3 and SRX Series improperly validates the syntactic correctness of incoming SIP packets. An unauthenticated attacker can send a malformed INVITE packet, causing a flowd crash and restart, leading to a complete service outage.

A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to cause a Denial-of-Service (DoS). Issuing specific 'show l2-learning' or 'show ethernet-switching' commands triggers an l2ald crash, temporarily impacting all layer 2 services until the process restarts.

A Use of Multiple Resources with Duplicate Identifier vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When a large number of VPN negotiations fail, a peer index rollover occurs, causing iked to crash repeatedly.

An improper validation of specified quantity in input vulnerability in the TCP proxy plugin of Juniper Networks Junos OS on MX Series with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial of Service (DoS) by sending a TCP packet with a malformed header, crashing the flowd process.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When the device initiates a TCP connection to an attacker-controlled system that responds with a specific packet, the PFE crashes and restarts, affecting all services until automatic recovery.

An out-of-bounds write vulnerability in the http-gatekeeper (http-gk) component of Junos OS on SRX Series allows an unauthenticated, network-based attacker to crash the http-gk process. The attack requires a remote-access VPN with pre-logon compliance check configured.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine of Junos OS on QFX10000 Series in an EVPN-VxLAN scenario allows an unauthenticated adjacent attacker to cause a DoS. Sending IPv6 multicast traffic to a non-IRB interface on a spine switch triggers an endless forwarding loop, saturating links and impacting legitimate traffic.

An improper validation of specified quantity in input vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). A crafted packet triggers incorrect size calculation, leading to an FPC major error and reset, disrupting traffic until recovery.

A missing authorization vulnerability in the CLI of Junos OS on EX2300, EX4000, EX4100, EX4300-MP, and EX4400 switches allows an authenticated local attacker with no specific permissions to execute a privileged 'request' command, causing a complete traffic impact until automatic recovery.

A vulnerability in Juniper Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS) by continuously flapping Micro-BFD sessions. This overloads the PFEMAN process, preventing it from completing event processing, leading to watchdog timer expiry and FPC crash.

A NULL pointer dereference vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a local high-privileged attacker to set or deactivate a specific SSH configuration parameter, causing an mgd process crash and Denial of Service (DoS).

In Junos OS on MX Series with MPC10, MPC11, LC4800, LC9600 line cards and MX304, firewall filters applied to loopback interface lo0.n (where n is non-zero) are not executed when lo0.n is in the global VRF/default routing-instance. This allows an unauthenticated network-based attacker to bypass the configured firewall filter and access the device's control-plane.

A Missing Authentication for Critical Function vulnerability in command processing of Juniper Networks Junos OS allows a privileged local attacker to gain access to Linux-based line cards as root. This affects systems with Linux-based line cards including various MPC, LC, MX, SRX, EX, and PTX models.