PT-2021-12954 · Juniper Networks · Junos

Published 2021-04-22 · Updated 2021-04-27 · CVE-2021-0243

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS on EX4300 versions prior to 17.3R3-S10 Juniper Networks Junos OS on EX4300 versions 17.4 prior to 17.4R3-S3 Juniper Networks Junos OS on EX4300 versions 18.1 prior to 18.1R3-S11 Juniper Networks Junos OS on EX4300 versions 18.2 prior to 18.2R3-S6 Juniper Networks Junos OS on EX4300 versions 18.3 prior to 18.3R3-S4 Juniper Networks Junos OS on EX4300 versions 18.4 prior to 18.4R3-S6 Juniper Networks Junos OS on EX4300 versions 19.1 prior to 19.1R3-S3 Juniper Networks Junos OS on EX4300 versions 19.2 prior to 19.2R3-S1 Juniper Networks Junos OS on EX4300 versions 19.3 prior to 19.3R3-S1 Juniper Networks Junos OS on EX4300 versions 19.4 prior to 19.4R3 Juniper Networks Junos OS on EX4300 versions 20.1 prior to 20.1R2 Juniper Networks Junos OS on EX4300 versions 20.2 prior to 20.2R2

Description: The issue is related to improper handling of unexpected data in the firewall policer of Juniper Networks Junos OS on EX4300 switches. This allows matching traffic to exceed set policer limits, possibly leading to a limited Denial of Service (DoS) condition. The problem occurs when the firewall policer discard action fails on a Layer 2 port, allowing traffic to pass even though it exceeds set policer limits. This issue only affects IPv4 policing and can be observed by comparing the Input bytes with the Output bytes using the command user@junos> monitor interface traffic.

Recommendations: For versions prior to 17.3R3-S10, update to 17.3R3-S10 or later. For versions 17.4 prior to 17.4R3-S3, update to 17.4R3-S3 or later. For versions 18.1 prior to 18.1R3-S11, update to 18.1R3-S11 or later. For versions 18.2 prior to 18.2R3-S6, update to 18.2R3-S6 or later. For versions 18.3 prior to 18.3R3-S4, update to 18.3R3-S4 or later. For versions 18.4 prior to 18.4R3-S6, update to 18.4R3-S6 or later. For versions 19.1 prior to 19.1R3-S3, update to 19.1R3-S3 or later. For versions 19.2 prior to 19.2R3-S1, update to 19.2R3-S1 or later. For versions 19.3 prior to 19.3R3-S1, update to 19.3R3-S1 or later. For versions 19.4 prior to 19.4R3, update to 19.4R3 or later. For versions 20.1 prior to 20.1R2, update to 20.1R2 or later. For versions 20.2 prior to 20.2R2, update to 20.2R2 or later.

Fix

DoS

Weakness Enumeration

CWE-241

Related Identifiers

CVE-2021-0243

Affected Products

Junos

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-0243 · Security Note
• https://kb.juniper.net/JSA11136 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-0243 · Vendor Advisory