CVSS: 6.1EPSS: 0%CPEs: 42EXPL: 0CVE-2023-44189 – Junos OS Evolved: PTX10003 Series: MAC address validation bypass vulnerability
https://notcve.org/view.php?id=CVE-2023-44189
An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10003 Series allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device. This issue affects Juniper Networks Junos OS Evolved on PTX10003 Series: * All versions prior to 21.4R3-S4-EVO; * 22.1 versions prior to 22.1R3-S3-EVO; * 22.2 version 22.2R1-EVO and later versions; * 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO; * 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO; * 23.2 versions prior to 23.2R2-EVO. Una vulnerabilidad de validación de origen en la validación de direcciones MAC de Juniper Networks Junos OS Evolved en la serie PTX10003 permite que un atacante adyacente a la red omita la verificación de direcciones MAC, lo que permite que las direcciones MAC que no están destinadas a llegar a la LAN adyacente se reenvíen a la red descendente. Debido a este problema, el router comenzará a reenviar tráfico si hay una ruta válida en la tabla de reenvío, lo que provocará un bucle y una congestión en el dominio de capa 2 descendente conectado al dispositivo. Este problema afecta a Juniper Networks Junos OS Evolved en la serie PTX10003: * Todas las versiones anteriores a 21.4R3-S4-EVO; * Versiones 22.1 anteriores a 22.1R3-S3-EVO; * 22.2 versión 22.2R1-EVO y versiones posteriores; * Versiones 22.3 anteriores a 22.3R2-S2-EVO, 22.3R3-S1-EVO; * Versiones 22.4 anteriores a 22.4R2-S1-EVO, 22.4R3-EVO; * Versiones 23.2 anteriores a 23.2R2-EVO. • https://supportportal.juniper.net/JSA73153 • CWE-346: Origin Validation Error •
CVSS: 7.5EPSS: 0%CPEs: 183EXPL: 0CVE-2023-44186 – Junos OS and Junos OS Evolved: RPD crash when attempting to send a very long AS PATH to a non-4-byte-AS capable BGP neighbor
https://notcve.org/view.php?id=CVE-2023-44186
An Improper Handling of Exceptional Conditions vulnerability in AS PATH processing of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to send a BGP update message with an AS PATH containing a large number of 4-byte ASes, leading to a Denial of Service (DoS). Continued receipt and processing of these BGP updates will create a sustained Denial of Service (DoS) condition. This issue is hit when the router has Non-Stop Routing (NSR) enabled, has a non-4-byte-AS capable BGP neighbor, receives a BGP update message with a prefix that includes a long AS PATH containing large number of 4-byte ASes, and has to advertise the prefix towards the non-4-byte-AS capable BGP neighbor. Note: NSR is not supported on the SRX Series and is therefore not affected by this vulnerability. This issue affects: Juniper Networks Junos OS: * All versions prior to 20.4R3-S8; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S6; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3-S1; * 22.4 versions prior to 22.4R2-S1, 22.4R3. Juniper Networks Junos OS Evolved * All versions prior to 20.4R3-S8-EVO; * 21.1 versions 21.1R1-EVO and later; * 21.2 versions prior to 21.2R3-S6-EVO; * 21.3 versions prior to 21.3R3-S5-EVO; * 21.4 versions prior to 21.4R3-S5-EVO; * 22.1 versions prior to 22.1R3-S4-EVO; * 22.2 versions prior to 22.2R3-S2-EVO; * 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO; * 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO. Una vulnerabilidad de Improper Handling of Exceptional Conditions en el procesamiento AS PATH de Juniper Networks Junos OS y Junos OS Evolved permite a un atacante enviar un mensaje de actualización de BGP con un AS PATH que contiene una gran cantidad de AS de 4 bytes, lo que lleva a una Denegación de Servicio ( DoS). La recepción y el procesamiento continuo de estas actualizaciones de BGP crearán una condición sostenida de Denegación de Servicio (DoS). Este problema se produce cuando el router tiene habilitado Non-Stop Routing (NSR), tiene un vecino BGP que no es de 4 bytes con capacidad AS, recibe un mensaje de actualización de BGP con un prefijo que incluye un AS PATH largo que contiene una gran cantidad de 4 bytes. • https://supportportal.juniper.net/JSA73150 • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-4481 – Junos OS and Junos OS Evolved: A crafted BGP UPDATE message allows a remote attacker to de-peer (reset) BGP sessions (CVE-2023-4481)
https://notcve.org/view.php?id=CVE-2023-4481
An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When certain specific crafted BGP UPDATE messages are received over an established BGP session, one BGP session may be torn down with an UPDATE message error, or the issue may propagate beyond the local system which will remain non-impacted, but may affect one or more remote systems. This issue is exploitable remotely as the crafted UPDATE message can propagate through unaffected systems and intermediate BGP speakers. Continuous receipt of the crafted BGP UPDATE messages will create a sustained Denial of Service (DoS) condition for impacted devices. This issue affects eBGP and iBGP, in both IPv4 and IPv6 implementations. This issue requires a remote attacker to have at least one established BGP session. An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When certain specific crafted BGP UPDATE messages are received over an established BGP session, one BGP session may be torn down with an UPDATE message error, or the issue may propagate beyond the local system which will remain non-impacted, but may affect one or more remote systems. This issue is exploitable remotely as the crafted UPDATE message can propagate through unaffected systems and intermediate BGP speakers. Continuous receipt of the crafted BGP UPDATE messages will create a sustained Denial of Service (DoS) condition for impacted devices. This issue affects eBGP and iBGP, in both IPv4 and IPv6 implementations. • https://kb.juniper.net/JSA72510 https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/topic-map/bgp-error-messages.html https://www.rfc-editor.org/rfc/rfc4271 https://www.rfc-editor.org/rfc/rfc7606 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 61EXPL: 0CVE-2023-36833 – Junos OS Evolved: PTX10001-36MR, and PTX10004, PTX10008, PTX10016 with LC1201/1202: The aftman-bt process will crash in a MoFRR scenario after multiple link flaps
https://notcve.org/view.php?id=CVE-2023-36833
A Use After Free vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS Evolved on PTX10001-36MR, and PTX10004, PTX10008, PTX10016 with LC1201/1202 allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). The process 'aftman-bt' will crash after multiple flaps on a multicast-only fast reroute (MoFRR) enabled interface. This will cause the respective FPC to stop forwarding traffic and it needs to be rebooted to restore the service. An indication that the system experienced this issue is the following log message: <date> <hostname> evo-aftmand-bt[<pid>]: [Error] jexpr_fdb: sanity check failed, ... , app_name L3 Mcast Routes This issue affects Juniper Networks Junos OS Evolved on PTX10001-36MR, PTX10004, PTX10008, PTX10016 with LC1201/1202: 21.2 version 21.2R1-EVO and later versions; 21.3 version 21.3R1-EVO and later versions; 21.4 versions prior to 21.4R3-S3-EVO; 22.1 version 22.1R1-EVO and later versions; 22.2 versions prior to 22.2R3-S2-EVO; 22.3 versions prior to 22.3R3-EVO; 22.4 versions prior to 22.4R1-S2-EVO, 22.4R2-EVO. • https://supportportal.juniper.net/JSA71640 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 176EXPL: 0CVE-2023-0026 – 2023-06: Out-of-Cycle Security Bulletin: Junos OS and Junos OS Evolved: A BGP session will flap upon receipt of a specific, optional transitive attribute
https://notcve.org/view.php?id=CVE-2023-0026
An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When a BGP update message is received over an established BGP session, and that message contains a specific, optional transitive attribute, this session will be torn down with an update message error. This issue cannot propagate beyond an affected system as the processing error occurs as soon as the update is received. This issue is exploitable remotely as the respective attribute can propagate through unaffected systems and intermediate AS (if any). Continuous receipt of a BGP update containing this attribute will create a sustained Denial of Service (DoS) condition. • https://supportportal.juniper.net/JSA71542 https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/topic-map/bgp-error-messages.html • CWE-20: Improper Input Validation •