PT-2020-1614 · Juniper Networks · Junos

Published

2020-01-10

·

Updated

2021-09-14

·

CVE-2020-1603

CVSS v3.1

8.6

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 16.1R7-S6 Juniper Networks Junos OS 16.1 version 16.1X70-D10 and later Juniper Networks Junos OS 16.2 versions prior to 16.2R2-S11 Juniper Networks Junos OS 17.1 versions prior to 17.1R2-S11, 17.1R3-S1 Juniper Networks Junos OS 17.2 versions prior to 17.2R1-S9, 17.2R2-S8, 17.2R3-S3 Juniper Networks Junos OS 17.3 versions prior to 17.3R3-S6 Juniper Networks Junos OS 17.4 versions prior to 17.4R2-S9, 17.4R3 Juniper Networks Junos OS 18.1 versions prior to 18.1R3-S7 Juniper Networks Junos OS 18.2 versions prior to 18.2R3-S2 Juniper Networks Junos OS 18.2X75 versions prior to 18.2X75-D50, 18.2X75-D410 Juniper Networks Junos OS 18.3 versions prior to 18.3R1-S6, 18.3R2-S2, 18.3R3 Juniper Networks Junos OS 18.4 versions prior to 18.4R1-S6, 18.4R2-S2, 18.4R3 Juniper Networks Junos OS 19.1 versions prior to 19.1R1-S3, 19.1R2 Juniper Networks Junos OS 19.2 versions prior to 19.2R1-S2, 19.2R2
Description The issue is related to the improper handling of specific IPv6 packets by the Routing Engine (RE) in Juniper Networks Junos OS, leading to a memory leak and potentially causing a Denial of Service (DoS) condition. The memory leak occurs when the RE allows these specific IPv6 packets to egress, causing a kernel crash or the device to hang, requiring a power cycle to restore service. In some scenarios, traffic from client devices may be black holed if it matches the condition of being processed by the RE. Continued receipt and attempted egress of these specific IPv6 packets will create an extended Denial of Service (DoS) condition.
Recommendations For Juniper Networks Junos OS versions prior to 16.1R7-S6, update to version 16.1R7-S6 or later. For Juniper Networks Junos OS 16.1 version 16.1X70-D10 and later, update to a version that is not affected. For Juniper Networks Junos OS 16.2 versions prior to 16.2R2-S11, update to version 16.2R2-S11 or later. For Juniper Networks Junos OS 17.1 versions prior to 17.1R2-S11, 17.1R3-S1, update to version 17.1R2-S11, 17.1R3-S1 or later. For Juniper Networks Junos OS 17.2 versions prior to 17.2R1-S9, 17.2R2-S8, 17.2R3-S3, update to version 17.2R1-S9, 17.2R2-S8, 17.2R3-S3 or later. For Juniper Networks Junos OS 17.3 versions prior to 17.3R3-S6, update to version 17.3R3-S6 or later. For Juniper Networks Junos OS 17.4 versions prior to 17.4R2-S9, 17.4R3, update to version 17.4R2-S9, 17.4R3 or later. For Juniper Networks Junos OS 18.1 versions prior to 18.1R3-S7, update to version 18.1R3-S7 or later. For Juniper Networks Junos OS 18.2 versions prior to 18.2R3-S2, update to version 18.2R3-S2 or later. For Juniper Networks Junos OS 18.2X75 versions prior to 18.2X75-D50, 18.2X75-D410, update to version 18.2X75-D50, 18.2X75-D410 or later. For Juniper Networks Junos OS 18.3 versions prior to 18.3R1-S6, 18.3R2-S2, 18.3R3, update to version 18.3R1-S6, 18.3R2-S2, 18.3R3 or later. For Juniper Networks Junos OS 18.4 versions prior to 18.4R1-S6, 18.4R2-S2, 18.4R3, update to version 18.4R1-S6, 18.4R2-S2, 18.4R3 or later. For Juniper Networks Junos OS 19.1 versions prior to 19.1R1-S3, 19.1R2, update to version 19.1R1-S3, 19.1R2 or later. For Juniper Networks Junos OS 19.2 versions prior to 19.2R1-S2, 19.2R2, update to version 19.2R1-S2, 19.2R2 or later.

Fix

DoS

Missing Release of Resource after Effective Lifetime

Memory Leak

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-772CWE-401CWE-710

Related Identifiers

BDU:2020-00792
CVE-2020-1603

Affected Products

Junos