CVSS: 7.5EPSS: 0%CPEs: 86EXPL: 0CVE-2023-44192 – Junos OS: QFX5000 Series: DMA memory leak is observed when specific DHCP packets are transmitted over pseudo-VTEP
https://notcve.org/view.php?id=CVE-2023-44192
An Improper Input Validation vulnerability in the Packet Forwarding Engine of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause memory leak, leading to Denial of Service (DoS). On all Junos OS QFX5000 Series platforms, when pseudo-VTEP (Virtual Tunnel End Point) is configured under EVPN-VXLAN scenario, and specific DHCP packets are transmitted, DMA memory leak is observed. Continuous receipt of these specific DHCP packets will cause memory leak to reach 99% and then cause the protocols to stop working and traffic is impacted, leading to Denial of Service (DoS) condition. A manual reboot of the system recovers from the memory leak. To confirm the memory leak, monitor for "sheaf:possible leak" and "vtep not found" messages in the logs. This issue affects: Juniper Networks Junos OS QFX5000 Series: * All versions prior to 20.4R3-S6; * 21.1 versions prior to 21.1R3-S5; * 21.2 versions prior to 21.2R3-S5; * 21.3 versions prior to 21.3R3-S4; * 21.4 versions prior to 21.4R3-S3; * 22.1 versions prior to 22.1R3-S2; * 22.2 versions prior to 22.2R2-S2, 22.2R3; * 22.3 versions prior to 22.3R2-S1, 22.3R3; * 22.4 versions prior to 22.4R1-S2, 22.4R2. Una vulnerabilidad de validación de entrada incorrecta en Packet Forwarding Engine (PFE) de Juniper Networks Junos OS permite que un atacante basado en red no autenticado cause una pérdida de memoria, lo que lleva a una Denegación de Servicio (DoS). En todas las plataformas de la serie Junos OS QFX5000, cuando se configura pseudo-VTEP (Virtual Tunnel End Point) en el escenario EVPN-VXLAN y se transmiten paquetes DHCP específicos, se observa una pérdida de memoria DMA. • https://supportportal.juniper.net/JSA73156 • CWE-20: Improper Input Validation CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.5EPSS: 0%CPEs: 129EXPL: 0CVE-2023-44185 – Junos OS and Junos OS Evolved: In an BGP scenario RPD crashes upon receiving and processing a specific malformed ISO VPN BGP UPDATE packet
https://notcve.org/view.php?id=CVE-2023-44185
An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks allows an attacker to cause a Denial of Service (DoS )to the device upon receiving and processing a specific malformed ISO VPN BGP UPDATE packet. Continued receipt of this packet will cause a sustained Denial of Service condition. This issue affects: * Juniper Networks Junos OS: * All versions prior to 20.4R3-S6; * 21.1 versions prior to 21.1R3-S5; * 21.2 versions prior to 21.2R3-S4; * 21.3 versions prior to 21.3R3-S3; * 21.4 versions prior to 21.4R3-S3; * 22.1 versions prior to 22.1R2-S2, 22.1R3; * 22.2 versions prior to 22.2R2-S1, 22.2R3; * 22.3 versions prior to 22.3R1-S2, 22.3R2. Juniper Networks Junos OS Evolved: * All versions prior to 20.4R3-S6-EVO; * 21.1-EVO version 21.1R1-EVO and later versions prior to 21.2R3-S4-EVO; * 21.3-EVO versions prior to 21.3R3-S3-EVO; * 21.4-EVO versions prior to 21.4R3-S3-EVO; * 22.1-EVO versions prior to 22.1R3-EVO; * 22.2-EVO versions prior to 22.2R2-S1-EVO, 22.2R3-EVO; * 22.3-EVO versions prior to 22.3R1-S2-EVO, 22.3R2-EVO. Una vulnerabilidad de validación de entrada incorrecta en el Routing Protocol Daemon (rpd) de Juniper Networks permite a un atacante causar una Denegación de Servicio (DoS) al dispositivo al recibir y procesar un paquete de ACTUALIZACIÓN BGP de VPN ISO con formato incorrecto específico. La recepción continua de este paquete provocará una condición sostenida de Denegación de Servicio. Este problema afecta a: * Juniper Networks Junos OS: * Todas las versiones anteriores a 20.4R3-S6; * Versiones 21.1 anteriores a 21.1R3-S5; * Versiones 21.2 anteriores a 21.2R3-S4; * Versiones 21.3 anteriores a 21.3R3-S3; * Versiones 21.4 anteriores a 21.4R3-S3; * Versiones 22.1 anteriores a 22.1R2-S2, 22.1R3; * Versiones 22.2 anteriores a 22.2R2-S1, 22.2R3; * Versiones 22.3 anteriores a 22.3R1-S2, 22.3R2. Juniper Networks Junos OS Evolved: * Todas las versiones anteriores a 20.4R3-S6-EVO; * 21.1-EVO versión 21.1R1-EVO y versiones posteriores anteriores a 21.2R3-S4-EVO; * Versiones 21.3-EVO anteriores a 21.3R3-S3-EVO; * Versiones 21.4-EVO anteriores a 21.4R3-S3-EVO; * Versiones 22.1-EVO anteriores a 22.1R3-EVO; * Versiones 22.2-EVO anteriores a 22.2R2-S1-EVO, 22.2R3-EVO; * Versiones 22.3-EVO anteriores a 22.3R1-S2-EVO, 22.3R2-EVO. • https://supportportal.juniper.net/JSA73146 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 109EXPL: 0CVE-2023-44184 – Junos OS and Junos OS Evolved: High CPU load due to specific NETCONF command
https://notcve.org/view.php?id=CVE-2023-44184
An Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the management daemon (mgd) process of Juniper Networks Junos OS and Junos OS Evolved allows a network-based authenticated low-privileged attacker, by executing a specific command via NETCONF, to cause a CPU Denial of Service to the device's control plane. This issue affects: Juniper Networks Junos OS * All versions prior to 20.4R3-S7; * 21.2 versions prior to 21.2R3-S5; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S4; * 22.1 versions prior to 22.1R3-S2; * 22.2 versions prior to 22.2R3; * 22.3 versions prior to 22.3R2-S1, 22.3R3; * 22.4 versions prior to 22.4R1-S2, 22.4R2. Juniper Networks Junos OS Evolved * All versions prior to 21.4R3-S4-EVO; * 22.1 versions prior to 22.1R3-S2-EVO; * 22.2 versions prior to 22.2R3-EVO; * 22.3 versions prior to 22.3R3-EVO; * 22.4 versions prior to 22.4R2-EVO. An indicator of compromise can be seen by first determining if the NETCONF client is logged in and fails to log out after a reasonable period of time and secondly reviewing the WCPU percentage for the mgd process by running the following command: mgd process example: user@device-re#> show system processes extensive | match "mgd|PID" | except last PID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND 92476 root 100 0 500M 89024K CPU3 3 57.5H 89.60% mgd <<<<<<<<<<< review the high cpu percentage. Example to check for NETCONF activity: While there is no specific command that shows a specific session in use for NETCONF, you can review logs for UI_LOG_EVENT with "client-mode 'netconf'" For example: mgd[38121]: UI_LOGIN_EVENT: User 'root' login, class 'super-user' [38121], ssh-connection '10.1.1.1 201 55480 10.1.1.2 22', client-mode 'netconf' Una vulnerabilidad de restricción inadecuada de operaciones dentro de los límites de un búfer de memoria en el proceso del Management Daemon (mgd) de Juniper Networks Junos OS y Junos OS Evolved permite a un atacante con pocos privilegios autenticado basado en red, ejecutando un comando específico a través de NETCONF, para provocar una Denegación de Servicio (DoS) de la CPU en el plano de control del dispositivo. Este problema afecta a: Juniper Networks Junos OS * Todas las versiones anteriores a 20.4R3-S7; * Versiones 21.2 anteriores a 21.2R3-S5; * Versiones 21.3 anteriores a 21.3R3-S5; * Versiones 21.4 anteriores a 21.4R3-S4; * Versiones 22.1 anteriores a 22.1R3-S2; * Versiones 22.2 anteriores a 22.2R3; * Versiones 22.3 anteriores a 22.3R2-S1, 22.3R3; * Versiones 22.4 anteriores a 22.4R1-S2, 22.4R2. Juniper Networks Junos OS Evolved * Todas las versiones anteriores a 21.4R3-S4-EVO; * Versiones 22.1 anteriores a 22.1R3-S2-EVO; * Versiones 22.2 anteriores a 22.2R3-EVO; * Versiones 22.3 anteriores a 22.3R3-EVO; * Versiones 22.4 anteriores a 22.4R2-EVO. Se puede ver un indicador de compromiso determinando primero si el cliente NETCONF ha iniciado sesión y no logra cerrar sesión después de un período de tiempo razonable y, en segundo lugar, revisando el porcentaje de WCPU para el proceso mgd ejecutando el siguiente comando: mgd process example: user@device-re#> show system processes extensive | match "mgd|PID" | excepto el último PID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND 92476 root 100 0 500M 89024K CPU3 3 57.5H 89.60% mgd <<<<<<<<<<< revise el alto porcentaje de CPU. Ejemplo para comprobar la actividad de NETCONF: si bien no existe un comando específico que muestre una sesión específica en uso para NETCONF, puede revisar los registros de UI_LOG_EVENT con "client-mode 'netconf'". • https://supportportal.juniper.net/JSA73147 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 0%CPEs: 250EXPL: 0CVE-2023-44183 – Junos OS: QFX5000 Series, EX4600 Series: In a VxLAN scenario an adjacent attacker within the VxLAN sending genuine packets may cause a DMA memory leak to occur.
https://notcve.org/view.php?id=CVE-2023-44183
An Improper Input Validation vulnerability in the VxLAN packet forwarding engine (PFE) of Juniper Networks Junos OS on QFX5000 Series, EX4600 Series devices allows an unauthenticated, adjacent attacker, sending two or more genuine packets in the same VxLAN topology to possibly cause a DMA memory leak to occur under various specific operational conditions. The scenario described here is the worst-case scenario. There are other scenarios that require operator action to occur. An indicator of compromise may be seen when multiple devices indicate that FPC0 has gone missing when issuing a show chassis fpc command for about 10 to 20 minutes, and a number of interfaces have also gone missing. Use the following command to determine if FPC0 has gone missing from the device. show chassis fpc detail This issue affects: Juniper Networks Junos OS on QFX5000 Series, EX4600 Series: * 18.4 version 18.4R2 and later versions prior to 20.4R3-S8; * 21.1 version 21.1R1 and later versions prior to 21.2R3-S6; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S4; * 22.1 versions prior to 22.1R3-S3; * 22.2 versions prior to 22.2R3-S1; * 22.3 versions prior to 22.3R2-S2, 22.3R3; * 22.4 versions prior to 22.4R2. Una vulnerabilidad de validación de entrada incorrecta en Packet Forwarding Engine (PFE) VxLAN de Juniper Networks Junos OS en dispositivos de las series QFX5000 y EX4600 permite que un atacante adyacente no autenticado envíe dos o más paquetes genuinos en la misma topología VxLAN para causar posiblemente una memoria DMA que se produzca una fuga en diversas condiciones operativas específicas. El escenario descrito aquí es el peor de los casos. • https://supportportal.juniper.net/JSA73148 https://www.juniper.net/documentation/us/en/software/junos/evpn-vxlan/topics/topic-map/sdn-vxlan.html https://www.juniper.net/documentation/us/en/software/junos/multicast-l2/topics/topic-map/redundant-trunk-groups.html • CWE-20: Improper Input Validation CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 8.8EPSS: 0%CPEs: 102EXPL: 0CVE-2023-44182 – Junos OS and Junos OS Evolved: An Unchecked Return Value in multiple users interfaces affects confidentiality and integrity of device operations
https://notcve.org/view.php?id=CVE-2023-44182
An Unchecked Return Value vulnerability in the user interfaces to the Juniper Networks Junos OS and Junos OS Evolved, the CLI, the XML API, the XML Management Protocol, the NETCONF Management Protocol, the gNMI interfaces, and the J-Web User Interfaces causes unintended effects such as demotion or elevation of privileges associated with an operators actions to occur. Multiple scenarios may occur; for example: privilege escalation over the device or another account, access to files that should not otherwise be accessible, files not being accessible where they should be accessible, code expected to run as non-root may run as root, and so forth. This issue affects: Juniper Networks Junos OS * All versions prior to 20.4R3-S7; * 21.1 versions prior to 21.1R3-S5; * 21.2 versions prior to 21.2R3-S5; * 21.3 versions prior to 21.3R3-S4; * 21.4 versions prior to 21.4R3-S3; * 22.1 versions prior to 22.1R3-S2; * 22.2 versions prior to 22.2R2-S2, 22.2R3; * 22.3 versions prior to 22.3R1-S2, 22.3R2. Juniper Networks Junos OS Evolved * All versions prior to 21.4R3-S3-EVO; * 22.1-EVO version 22.1R1-EVO and later versions prior to 22.2R2-S2-EVO, 22.2R3-EVO; * 22.3-EVO versions prior to 22.3R1-S2-EVO, 22.3R2-EVO. Una vulnerabilidad de valor de retorno no verificado en las interfaces de usuario de Juniper Networks Junos OS y Junos OS Evolved, el CLI, la API XML, el protocolo de administración XML, el protocolo de administración NETCONF, las interfaces gNMI y las interfaces de usuario J-Web provoca causas no deseadas. Se producirán efectos tales como degradación o elevación de privilegios asociados con las acciones de un operador. Pueden ocurrir múltiples escenarios; por ejemplo: escalada de privilegios sobre el dispositivo u otra cuenta, acceso a archivos que de otro modo no deberían ser accesibles, archivos que no son accesibles donde deberían serlo, código que se espera que se ejecute como no root puede ejecutarse como root, etc. Este problema afecta a: Juniper Networks Junos OS * Todas las versiones anteriores a 20.4R3-S7; * Versiones 21.1 anteriores a 21.1R3-S5; * Versiones 21.2 anteriores a 21.2R3-S5; * Versiones 21.3 anteriores a 21.3R3-S4; * Versiones 21.4 anteriores a 21.4R3-S3; * Versiones 22.1 anteriores a 22.1R3-S2; * Versiones 22.2 anteriores a 22.2R2-S2, 22.2R3; * Versiones 22.3 anteriores a 22.3R1-S2, 22.3R2. • https://supportportal.juniper.net/JSA73149 https://www.juniper.net/documentation/en_US/junos/topics/concept/junos-software-user-interfaces-overview.html https://www.juniper.net/documentation/us/en/software/junos/interfaces-telemetry/topics/concept/junos-telemetry-interface-grpc-sensors.html • CWE-252: Unchecked Return Value •