PT-2021-3308 · Juniper Networks · Junos

Published

2021-04-14

·

Updated

2021-04-27

·

CVE-2021-0251

CVSS v3.1

8.6

High

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS on MX Series versions 17.3R1 through 17.4R2-S8 Juniper Networks Junos OS on MX Series versions 17.4R3-S1 through 17.4R3-S2 Juniper Networks Junos OS on MX Series versions 18.1R1 through 18.1R3-S8 Juniper Networks Junos OS on MX Series versions 18.2R1 through 18.2R3-S2 Juniper Networks Junos OS on MX Series versions 18.3R1 through 18.3R3 Juniper Networks Junos OS on MX Series versions 18.4R1 through 18.4R2 Juniper Networks Junos OS on MX Series versions 19.1R1 through 19.1R2-S1 Juniper Networks Junos OS on MX Series versions 19.2R1 through 19.2R1
Description A NULL Pointer Dereference issue in the Captive Portal Content Delivery (CPCD) services daemon of Juniper Networks Junos OS on MX Series allows an attacker to send malformed HTTP packets to the device, causing a Denial of Service (DoS) and crashing the Multiservices PIC Management Daemon process. This prevents users from logging in and impacts other services and traffic through the device. The issue can be exploited by sending specially crafted HTTP packets, but only affects devices with the Captive Portal experience.
Recommendations For Juniper Networks Junos OS on MX Series versions 17.3R1 through 17.4R2-S8, update to version 17.4R2-S9 or later. For Juniper Networks Junos OS on MX Series versions 17.4R3-S1 through 17.4R3-S2, update to version 17.4R3-S2 or later. For Juniper Networks Junos OS on MX Series versions 18.1R1 through 18.1R3-S8, update to version 18.1R3-S9 or later. For Juniper Networks Junos OS on MX Series versions 18.2R1 through 18.2R3-S2, update to version 18.2R3-S3 or later. For Juniper Networks Junos OS on MX Series versions 18.3R1 through 18.3R3, update to version 18.3R3-S1 or later. For Juniper Networks Junos OS on MX Series versions 18.4R1 through 18.4R2, update to version 18.4R3 or later. For Juniper Networks Junos OS on MX Series versions 19.1R1 through 19.1R2-S1, update to version 19.1R2-S2 or later. For Juniper Networks Junos OS on MX Series versions 19.2R1 through 19.2R1, update to version 19.2R2 or later.

Fix

DoS

NULL Pointer Dereference

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2021-03084
CVE-2021-0251

Affected Products

Junos