CVSS: 8.7EPSS: 0%CPEs: 14EXPL: 0CVE-2024-39555 – Junos OS and Junos OS Evolved: Receipt of a specific malformed BGP update causes the session to reset
https://notcve.org/view.php?id=CVE-2024-39555
An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specific malformed BGP update message to cause the session to reset, resulting in a Denial of Service (DoS). Continued receipt and processing of these malformed BGP update messages will create a sustained Denial of Service (DoS) condition. Upon receipt of a BGP update message over an established BGP session containing a specifically malformed tunnel encapsulation attribute, when segment routing is enabled, internal processing of the malformed attributes within the update results in improper parsing of remaining attributes, leading to session reset: BGP SEND Notification code 3 (Update Message Error) subcode 1 (invalid attribute list) Only systems with segment routing enabled are vulnerable to this issue. This issue affects eBGP and iBGP, in both IPv4 and IPv6 implementations, and requires a remote attacker to have at least one established BGP session. This issue affects: Junos OS: * All versions before 21.4R3-S8, * from 22.2 before 22.2R3-S4, * from 22.3 before 22.3R3-S3, * from 22.4 before 22.4R3-S3, * from 23.2 before 23.2R2-S1, * from 23.4 before 23.4R1-S2, 23.4R2. Junos OS Evolved: * All versions before 21.4R3-S8-EVO, * from 22.2-EVO before 22.2R3-S4-EVO, * from 22.3-EVO before 22.3R3-S3-EVO, * from 22.4-EVO before 22.4R3-S3-EVO, * from 23.2-EVO before 23.2R2-S1-EVO, * from 23.4-EVO before 23.4R1-S2-EVO, 23.4R2-EVO. Una vulnerabilidad de manejo inadecuado de condiciones excepcionales en el daemon de protocolo de enrutamiento (RPD) de Juniper Networks Junos OS y Junos OS Evolved permite que un atacante envíe un mensaje específico de actualización de BGP con formato incorrecto para provocar que la sesión se reinicie, lo que resulta en una denegación de servicio (DoS). La recepción y el procesamiento continuos de estos mensajes de actualización de BGP con formato incorrecto crearán una condición sostenida de denegación de servicio (DoS). Al recibir un mensaje de actualización de BGP a través de una sesión BGP establecida que contiene un atributo de encapsulación de túnel específicamente mal formado, cuando el enrutamiento de segmento está habilitado, el procesamiento interno de los atributos mal formados dentro de la actualización da como resultado un análisis inadecuado de los atributos restantes, lo que lleva al restablecimiento de la sesión: BGP SEND Código de notificación 3 (Error de mensaje de actualización) subcódigo 1 (lista de atributos no válidos) Solo los sistemas con enrutamiento de segmentos habilitado son vulnerables a este problema. • https://supportportal.juniper.net/JSA83015 • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 7.1EPSS: 0%CPEs: 23EXPL: 0CVE-2024-30380 – Junos OS and Junos OS Evolved: l2cpd crash upon receipt of a specific TLV
https://notcve.org/view.php?id=CVE-2024-30380
An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a Denial of Service (DoS), which causes the l2cpd process to crash by sending a specific TLV. The l2cpd process is responsible for layer 2 control protocols, such as STP, RSTP, MSTP, VSTP, ERP, and LLDP. The impact of the l2cpd crash is reinitialization of STP protocols (RSTP, MSTP or VSTP), and MVRP and ERP, leading to a Denial of Service. Continued receipt and processing of this specific TLV will create a sustained Denial of Service (DoS) condition. This issue affects: Junos OS: all versions before 20.4R3-S9, from 21.2 before 21.2R3-S7, from 21.3 before 21.3R3-S5, from 21.4 before 21.4R3-S4, from 22.1 before 22.1R3-S4, from 22.2 before 22.2R3-S2, from 22.3 before 22.3R2-S2, 22.3R3-S1, from 22.4 before 22.4R2-S2, 22.4R3, from 23.2 before 23.2R1-S1, 23.2R2; Junos OS Evolved: all versions before 21.2R3-S7, from 21.3 before 21.3R3-S5-EVO, from 21.4 before 21.4R3-S5-EVO, from 22.1 before 22.1R3-S4-EVO, from 22.2 before 22.2R3-S2-EVO, from 22.3 before 22.3R2-S2-EVO, 22.3R3-S1-EVO, from 22.4 before 22.4R2-S2-EVO, 22.4R3-EVO, from 23.2 before 23.2R1-S1-EVO, 23.2R2-EVO. Una vulnerabilidad de manejo inadecuado de condiciones excepcionales en Juniper Networks Junos OS y Junos OS Evolved permite que un atacante adyacente no autenticado provoque una denegación de servicio (DoS), lo que provoca que el proceso l2cpd se bloquee al enviar un TLV específico. El proceso l2cpd es responsable de los protocolos de control de capa 2, como STP, RSTP, MSTP, VSTP, ERP y LLDP. • https://supportportal.juniper.net/JSA79171 https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 6.9EPSS: 0%CPEs: 8EXPL: 0CVE-2024-30378 – Junos OS: MX Series: bbe-smgd process crash upon execution of specific CLI commands
https://notcve.org/view.php?id=CVE-2024-30378
A Use After Free vulnerability in command processing of Juniper Networks Junos OS on MX Series allows a local, authenticated attacker to cause the broadband edge service manager daemon (bbe-smgd) to crash upon execution of specific CLI commands, creating a Denial of Service (DoS) condition. The process crashes and restarts automatically. When specific CLI commands are executed, the bbe-smgd daemon attempts to write into an area of memory (mgd socket) that was already closed, causing the process to crash. This process manages and controls the configuration of broadband subscriber sessions and services. While the process is unavailable, additional subscribers will not be able to connect to the device, causing a temporary Denial of Service condition. This issue only occurs if Graceful Routing Engine Switchover (GRES) and Subscriber Management are enabled. This issue affects Junos OS: * All versions before 20.4R3-S5, * from 21.1 before 21.1R3-S4, * from 21.2 before 21.2R3-S3, * from 21.3 before 21.3R3-S5, * from 21.4 before 21.4R3-S5, * from 22.1 before 22.1R3, * from 22.2 before 22.2R3, * from 22.3 before 22.3R2; Una vulnerabilidad Use After Free en el procesamiento de comandos de Juniper Networks Junos OS en la serie MX permite que un atacante local autenticado provoque que el demonio del administrador de servicios de banda ancha (bbe-smgd) se bloquee al ejecutar comandos CLI específicos, creando una condición de denegación de servicio ( DoS). El proceso falla y se reinicia automáticamente. • https://supportportal.juniper.net/JSA79109 https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L • CWE-416: Use After Free •
CVSS: 8.7EPSS: 0%CPEs: 9EXPL: 0CVE-2024-30397 – Junos OS: An invalid certificate causes a Denial of Service in the Internet Key Exchange (IKE) process
https://notcve.org/view.php?id=CVE-2024-30397
An Improper Check for Unusual or Exceptional Conditions vulnerability in the the Public Key Infrastructure daemon (pkid) of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause Denial of Service (DoS). The pkid is responsible for the certificate verification. Upon a failed verification, the pkid uses all CPU resources and becomes unresponsive to future verification attempts. This means that all subsequent VPN negotiations depending on certificate verification will fail. This CPU utilization of pkid can be checked using this command: root@srx> show system processes extensive | match pkid xxxxx root 103 0 846M 136M CPU1 1 569:00 100.00% pkid This issue affects: Juniper Networks Junos OS * All versions prior to 20.4R3-S10; * 21.2 versions prior to 21.2R3-S7; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S3; * 22.3 versions prior to 22.3R3-S1; * 22.4 versions prior to 22.4R3; * 23.2 versions prior to 23.2R1-S2, 23.2R2. Una vulnerabilidad de verificación inadecuada de condiciones inusuales o excepcionales en el daemon de infraestructura de clave pública (pkid) de Juniper Networks Junos OS permite que un atacante en red no autenticado provoque una denegación de servicio (DoS). El pkid es responsable de la verificación del certificado. • https://supportportal.juniper.net/JSA79179 https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 6.3EPSS: 0%CPEs: 6EXPL: 0CVE-2024-30391 – Junos OS: MX Series with SPC3, and SRX Series: When IPsec authentication is configured with "hmac-sha-384" and "hmac-sha-512" no authentication of traffic is performed
https://notcve.org/view.php?id=CVE-2024-30391
A Missing Authentication for Critical Function vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an unauthenticated network-based attacker to cause limited impact to the integrity or availability of the device. If a device is configured with IPsec authentication algorithm hmac-sha-384 or hmac-sha-512, tunnels are established normally but for traffic traversing the tunnel no authentication information is sent with the encrypted data on egress, and no authentication information is expected on ingress. So if the peer is an unaffected device transit traffic is going to fail in both directions. If the peer is an also affected device transit traffic works, but without authentication, and configuration and CLI operational commands indicate authentication is performed. This issue affects Junos OS: * All versions before 20.4R3-S7, * 21.1 versions before 21.1R3, * 21.2 versions before 21.2R2-S1, 21.2R3, * 21.3 versions before 21.3R1-S2, 21.3R2. Una vulnerabilidad de autenticación faltante para función crítica en el motor de reenvío de paquetes (pfe) de Juniper Networks Junos OS en la serie MX con SPC3 y la serie SRX permite que un atacante basado en red no autenticado cause un impacto limitado en la integridad o disponibilidad del dispositivo. Si un dispositivo está configurado con el algoritmo de autenticación IPsec hmac-sha-384 o hmac-sha-512, los túneles se establecen normalmente, pero para el tráfico que atraviesa el túnel no se envía información de autenticación con los datos cifrados en la salida y no se espera información de autenticación en ingreso. • http://supportportal.juniper.net/JSA79188 https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N • CWE-306: Missing Authentication for Critical Function •