PT-2021-3882 · Juniper Networks · Junos

Published 2021-07-14 · Updated 2021-07-28 · CVE-2021-0295

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS on QFX10K Series versions 17.3 through 17.3R3-S11 Juniper Networks Junos OS on QFX10K Series versions 17.4 through 17.4R3-S4 Juniper Networks Junos OS on QFX10K Series versions 18.1 through 18.1R3-S12 Juniper Networks Junos OS on QFX10K Series version 18.2R1 Juniper Networks Junos OS on QFX10K Series versions 18.3 through 18.3R3-S4 Juniper Networks Junos OS on QFX10K Series versions 18.4 through 18.4R2-S8 Juniper Networks Junos OS on QFX10K Series versions 18.4 through 18.4R3-S7 Juniper Networks Junos OS on QFX10K Series versions 19.1 through 19.1R3-S4 Juniper Networks Junos OS on QFX10K Series versions 19.2 through 19.2R1-S6 Juniper Networks Junos OS on QFX10K Series versions 19.2 through 19.2R3-S1 Juniper Networks Junos OS on QFX10K Series versions 19.3 through 19.3R3-S1 Juniper Networks Junos OS on QFX10K Series versions 19.4 through 19.4R3-S2 Juniper Networks Junos OS on QFX10K Series versions 20.1 through 20.1R2-S1 Juniper Networks Junos OS on QFX10K Series versions 20.1 through 20.1R3 Juniper Networks Junos OS on QFX10K Series versions 20.2 through 20.2R2 Juniper Networks Junos OS on QFX10K Series versions 20.3 through 20.3R2 Juniper Networks Junos OS on QFX10K Series versions 20.4 through 20.4R1

Description A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) of Juniper Networks Junos OS on the QFX10K Series switches allows an attacker to trigger a packet forwarding loop, leading to a partial Denial of Service (DoS). The issue is caused by DVMRP packets looping on a multi-homed Ethernet Segment Identifier (ESI) when VXLAN is configured. DVMRP packets received on a multi-homed ESI are sent to the peer, and then incorrectly forwarded out the same ESI, violating the split horizon rule.

Recommendations As a temporary workaround, consider disabling the DVMRP protocol on the QFX10K Series switches until a patch is available. Restrict access to the multi-homed ESI to minimize the risk of exploitation. Avoid using the VXLAN configuration on the QFX10K Series switches until the issue is resolved. Update to a fixed version of Juniper Networks Junos OS on QFX10K Series, if available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-697

Related Identifiers

BDU:2021-04263

CVE-2021-0295

Affected Products

Junos

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-0295 · Security Note
• https://kb.juniper.net/JSA11208 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-0295 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04263 · Security Note
• https://t.me/cvenotify/17710 · Telegram Post