CVSS: 8.2EPSS: 0%CPEs: 16EXPL: 0CVE-2024-39554 – Junos OS and Junos OS Evolved: BGP multipath incremental calculation is resulting in an rpd crash
https://notcve.org/view.php?id=CVE-2024-39554
A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to inject incremental routing updates when BGP multipath is enabled, causing rpd to crash and restart, resulting in a Denial of Service (DoS). Since this is a timing issue (race condition), the successful exploitation of this vulnerability is outside the attacker's control. However, continued receipt and processing of this packet may create a sustained Denial of Service (DoS) condition. On all Junos OS and Junos OS Evolved platforms with BGP multipath enabled, a specific multipath calculation removes the original next hop from the multipath lead routes nexthop-set. When this change happens, multipath relies on certain internal timing to record the update. Under certain circumstance and with specific timing, this could result in an rpd crash. This issue only affects systems with BGP multipath enabled. This issue affects: Junos OS: * All versions of 21.1 * from 21.2 before 21.2R3-S7, * from 21.4 before 21.4R3-S6, * from 22.1 before 22.1R3-S5, * from 22.2 before 22.2R3-S3, * from 22.3 before 22.3R3-S2, * from 22.4 before 22.4R3, * from 23.2 before 23.2R2. Junos OS Evolved: * All versions of 21.1-EVO, * All versions of 21.2-EVO, * from 21.4-EVO before 21.4R3-S6-EVO, * from 22.1-EVO before 22.1R3-S5-EVO, * from 22.2-EVO before 22.2R3-S3-EVO, * from 22.3-EVO before 22.3R3-S2-EVO, * from 22.4-EVO before 22.4R3-EVO, * from 23.2-EVO before 23.2R2-EVO. Versions of Junos OS before 21.1R1 are unaffected by this vulnerability. Versions of Junos OS Evolved before 21.1R1-EVO are unaffected by this vulnerability. • https://supportportal.juniper.net/JSA83014 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.1EPSS: 0%CPEs: 23EXPL: 0CVE-2024-30380 – Junos OS and Junos OS Evolved: l2cpd crash upon receipt of a specific TLV
https://notcve.org/view.php?id=CVE-2024-30380
An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a Denial of Service (DoS), which causes the l2cpd process to crash by sending a specific TLV. The l2cpd process is responsible for layer 2 control protocols, such as STP, RSTP, MSTP, VSTP, ERP, and LLDP. The impact of the l2cpd crash is reinitialization of STP protocols (RSTP, MSTP or VSTP), and MVRP and ERP, leading to a Denial of Service. Continued receipt and processing of this specific TLV will create a sustained Denial of Service (DoS) condition. This issue affects: Junos OS: all versions before 20.4R3-S9, from 21.2 before 21.2R3-S7, from 21.3 before 21.3R3-S5, from 21.4 before 21.4R3-S4, from 22.1 before 22.1R3-S4, from 22.2 before 22.2R3-S2, from 22.3 before 22.3R2-S2, 22.3R3-S1, from 22.4 before 22.4R2-S2, 22.4R3, from 23.2 before 23.2R1-S1, 23.2R2; Junos OS Evolved: all versions before 21.2R3-S7, from 21.3 before 21.3R3-S5-EVO, from 21.4 before 21.4R3-S5-EVO, from 22.1 before 22.1R3-S4-EVO, from 22.2 before 22.2R3-S2-EVO, from 22.3 before 22.3R2-S2-EVO, 22.3R3-S1-EVO, from 22.4 before 22.4R2-S2-EVO, 22.4R3-EVO, from 23.2 before 23.2R1-S1-EVO, 23.2R2-EVO. Una vulnerabilidad de manejo inadecuado de condiciones excepcionales en Juniper Networks Junos OS y Junos OS Evolved permite que un atacante adyacente no autenticado provoque una denegación de servicio (DoS), lo que provoca que el proceso l2cpd se bloquee al enviar un TLV específico. El proceso l2cpd es responsable de los protocolos de control de capa 2, como STP, RSTP, MSTP, VSTP, ERP y LLDP. • https://supportportal.juniper.net/JSA79171 https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 8.2EPSS: 0%CPEs: 15EXPL: 0CVE-2024-30402 – Junos OS and Junos OS Evolved: The l2ald crashes on receiving telemetry messages from a specific subscription
https://notcve.org/view.php?id=CVE-2024-30402
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Layer 2 Address Learning Daemon (l2ald) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). When telemetry requests are sent to the device, and the Dynamic Rendering Daemon (drend) is suspended, the l2ald crashes and restarts due to factors outside the attackers control. Repeated occurrences of these events causes a sustained DoS condition. This issue affects: Junos OS: * All versions earlier than 20.4R3-S10; * 21.2 versions earlier than 21.2R3-S7; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S4; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S1; * 22.4 versions earlier than 22.4R3; * 23.2 versions earlier than 23.2R1-S2, 23.2R2. Junos OS Evolved: * All versions earlier than 21.4R3-S5-EVO; * 22.1-EVO versions earlier than 22.1R3-S4-EVO; * 22.2-EVO versions earlier than 22.2R3-S3-EVO; * 22.3-EVO versions earlier than 22.3R3-S1-EVO; * 22.4-EVO versions earlier than 22.4R3-EVO; * 23.2-EVO versions earlier than 23.2R2-EVO. Una verificación inadecuada de la vulnerabilidad de condiciones inusuales o excepcionales en el daemon de aprendizaje de direcciones de capa 2 (l2ald) de Juniper Networks Junos OS y Junos OS Evolved permite que un atacante adyacente no autenticado provoque una denegación de servicio (DoS). Cuando se envían solicitudes de telemetría al dispositivo y el daemon de renderizado dinámico (drend) se suspende, l2ald falla y se reinicia debido a factores fuera del control de los atacantes. La ocurrencia repetida de estos eventos causa una condición DoS sostenida. • https://supportportal.juniper.net/JSA79180 https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 8.7EPSS: 0%CPEs: 13EXPL: 0CVE-2024-30394 – Junos OS and Junos OS Evolved: A specific EVPN type-5 route causes rpd crash
https://notcve.org/view.php?id=CVE-2024-30394
A Stack-based Buffer Overflow vulnerability in the Routing Protocol Daemon (RPD) component of Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause an rpd crash, leading to Denial of Service (DoS). On all Junos OS and Junos OS Evolved platforms, when EVPN is configured, and a specific EVPN type-5 route is received via BGP, rpd crashes and restarts. Continuous receipt of this specific route will lead to a sustained Denial of Service (DoS) condition. This issue affects: Junos OS: * all versions before 21.2R3-S7, * from 21.4 before 21.4R3-S5, * from 22.1 before 22.1R3-S4, * from 22.2 before 22.2R3-S2, * from 22.3 before 22.3R3-S1, * from 22.4 before 22.4R3, * from 23.2 before 23.2R2. Junos OS Evolved: * all versions before 21.4R3-S5-EVO, * from 22.1-EVO before 22.1R3-S4-EVO, * from 22.2-EVO before 22.2R3-S2-EVO, * from 22.3-EVO before 22.3R3-S1-EVO, * from 22.4-EVO before 22.4R3-EVO, * from 23.2-EVO before 23.2R2-EVO. Una vulnerabilidad de desbordamiento de búfer en la región stack de la memoria en el componente Routing Protocol Daemon (RPD) de Junos OS y Junos OS Evolved permite que un atacante basado en red no autenticado provoque un bloqueo de rpd, lo que lleva a una denegación de servicio (DoS). En todas las plataformas Junos OS y Junos OS Evolved, cuando EVPN está configurado y se recibe una ruta EVPN tipo 5 específica a través de BGP, rpd se bloquea y se reinicia. La recepción continua de esta ruta específica dará lugar a una condición sostenida de Denegación de Servicio (DoS). • https://supportportal.juniper.net/JSA79094 https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L • CWE-121: Stack-based Buffer Overflow •
CVSS: 8.7EPSS: 0%CPEs: 17EXPL: 0CVE-2024-30395 – Junos OS and Junos OS Evolved: A malformed BGP tunnel encapsulation attribute will lead to an rpd crash
https://notcve.org/view.php?id=CVE-2024-30395
An Improper Validation of Specified Type of Input vulnerability in Routing Protocol Daemon (RPD) of Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause Denial of Service (DoS). If a BGP update is received over an established BGP session which contains a tunnel encapsulation attribute with a specifically malformed TLV, rpd will crash and restart. This issue affects: Junos OS: * all versions before 21.2R3-S7, * from 21.3 before 21.3R3-S5, * from 21.4 before 21.4R3-S5, * from 22.1 before 22.1R3-S5, * from 22.2 before 22.2R3-S3, * from 22.3 before 22.3R3-S2, * from 22.4 before 22.4R3, * from 23.2 before 23.2R1-S2, 23.2R2. Junos OS Evolved: * all versions before 21.2R3-S7-EVO, * from 21.3-EVO before 21.3R3-S5-EVO, * from 21.4-EVO before 21.4R3-S5-EVO, * from 22.2-EVO before 22.2R3-S3-EVO, * from 22.3-EVO before 22.3R3-S2-EVO, * from 22.4-EVO before 22.4R3-EVO, * from 23.2-EVO before 23.2R1-S2-EVO, 23.2R2-EVO. This is a related but separate issue than the one described in JSA75739 Una validación inadecuada de una vulnerabilidad de tipo específico de entrada en el daemon de protocolo de enrutamiento (RPD) de Junos OS y Junos OS Evolved permite que un atacante no autenticado basado en la red provoque una denegación de servicio (DoS). Si se recibe una actualización de BGP a través de una sesión BGP establecida que contiene un atributo de encapsulación de túnel con un TLV específicamente mal formado, rpd fallará y se reiniciará. Este problema afecta a: Junos OS: * todas las versiones anteriores a 21.2R3-S7, * desde 21.3 anterior a 21.3R3-S5, * desde 21.4 anterior a 21.4R3-S5, * desde 22.1 anterior a 22.1R3-S5, * desde 22.2 anterior a 22.2R3- S3, * desde 22.3 antes de 22.3R3-S2, * desde 22.4 antes de 22.4R3, * desde 23.2 antes de 23.2R1-S2, 23.2R2. Junos OS Evolved: * todas las versiones anteriores a 21.2R3-S7-EVO, * desde 21.3-EVO antes de 21.3R3-S5-EVO, * desde 21.4-EVO antes de 21.4R3-S5-EVO, * desde 22.2-EVO antes de 22.2R3- S3-EVO, * desde 22.3-EVO antes de 22.3R3-S2-EVO, * desde 22.4-EVO antes de 22.4R3-EVO, * desde 23.2-EVO antes de 23.2R1-S2-EVO, 23.2R2-EVO. Este es un problema relacionado pero separado del descrito en JSA75739. • https://supportportal.juniper.net/JSA79095 https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L • CWE-1287: Improper Validation of Specified Type of Input •