PT-2021-19274 · Juniper Networks · Junos

Published 2021-10-19 · Updated 2021-10-25 · CVE-2021-31377

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Junos OS versions prior to 15.1R7-S9 Junos OS versions prior to 17.3R3-S12 Junos OS versions prior to 17.4R2-S13 Junos OS versions prior to 17.4R3-S5 Junos OS versions prior to 18.1R3-S13 Junos OS versions prior to 18.2R3-S8 Junos OS versions prior to 18.3R3-S5 Junos OS versions prior to 18.4R2-S8 Junos OS versions prior to 18.4R3-S7 Junos OS versions prior to 19.1R2-S3 Junos OS versions prior to 19.1R3-S5 Junos OS versions prior to 19.2R3-S2 Junos OS versions prior to 19.3R2-S6 Junos OS versions prior to 19.3R3-S2 Junos OS versions prior to 19.4R1-S4 Junos OS versions prior to 19.4R2-S4 Junos OS versions prior to 19.4R3-S2 Junos OS versions prior to 20.1R2-S2 Junos OS versions prior to 20.1R3 Junos OS versions prior to 20.2R2-S3 Junos OS versions prior to 20.2R3 Junos OS versions prior to 20.3R3 Junos OS versions prior to 20.4R1-S1 Junos OS versions prior to 20.4R2

Description An Incorrect Permission Assignment for Critical Resource vulnerability in the filesystem of Junos OS allows a local authenticated attacker to cause the routing process daemon (RPD) to crash and restart, resulting in a Denial of Service (DoS). Repeated actions by the attacker can create a sustained Denial of Service (DoS) condition.

Recommendations For Junos OS versions prior to 15.1R7-S9, update to 15.1R7-S9 or later. For Junos OS versions prior to 17.3R3-S12, update to 17.3R3-S12 or later. For Junos OS versions prior to 17.4R2-S13, update to 17.4R2-S13 or later. For Junos OS versions prior to 17.4R3-S5, update to 17.4R3-S5 or later. For Junos OS versions prior to 18.1R3-S13, update to 18.1R3-S13 or later. For Junos OS versions prior to 18.2R3-S8, update to 18.2R3-S8 or later. For Junos OS versions prior to 18.3R3-S5, update to 18.3R3-S5 or later. For Junos OS versions prior to 18.4R2-S8, update to 18.4R2-S8 or later. For Junos OS versions prior to 18.4R3-S7, update to 18.4R3-S7 or later. For Junos OS versions prior to 19.1R2-S3, update to 19.1R2-S3 or later. For Junos OS versions prior to 19.1R3-S5, update to 19.1R3-S5 or later. For Junos OS versions prior to 19.2R3-S2, update to 19.2R3-S2 or later. For Junos OS versions prior to 19.3R2-S6, update to 19.3R2-S6 or later. For Junos OS versions prior to 19.3R3-S2, update to 19.3R3-S2 or later. For Junos OS versions prior to 19.4R1-S4, update to 19.4R1-S4 or later. For Junos OS versions prior to 19.4R2-S4, update to 19.4R2-S4 or later. For Junos OS versions prior to 19.4R3-S2, update to 19.4R3-S2 or later. For Junos OS versions prior to 20.1R2-S2, update to 20.1R2-S2 or later. For Junos OS versions prior to 20.1R3, update to 20.1R3 or later. For Junos OS versions prior to 20.2R2-S3, update to 20.2R2-S3 or later. For Junos OS versions prior to 20.2R3, update to 20.2R3 or later. For Junos OS versions prior to 20.3R3, update to 20.3R3 or later. For Junos OS versions prior to 20.4R1-S1, update to 20.4R1-S1 or later. For Junos OS versions prior to 20.4R2, update to 20.4R2 or later.

Fix

DoS

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2021-31377

Affected Products

Junos

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-31377 · Security Note
• https://kb.juniper.net/JSA11242 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31377 · Vendor Advisory