PT-2021-5119 · Juniper Networks · Junos
Published
2021-10-13
·
Updated
2021-10-27
·
CVE-2021-31379
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Juniper Networks Junos OS versions 17.2R1 and later versions;
Juniper Networks Junos OS versions 17.3 prior to 17.3R3-S9;
Juniper Networks Junos OS versions 17.4 prior to 17.4R2-S12, 17.4R3-S3;
Juniper Networks Junos OS versions 18.1 prior to 18.1R3-S11;
Juniper Networks Junos OS versions 18.2 prior to 18.2R2-S6, 18.2R3-S3;
Juniper Networks Junos OS versions 18.3 prior to 18.3R2-S4, 18.3R3-S1;
Juniper Networks Junos OS versions 18.4 prior to 18.4R1-S8, 18.4R2-S5, 18.4R3;
Juniper Networks Junos OS versions 19.1 prior to 19.1R1-S6, 19.1R2-S2, 19.1R3;
Juniper Networks Junos OS versions 19.2 prior to 19.2R1-S5, 19.2R2;
Juniper Networks Junos OS versions 19.3 prior to 19.3R2-S5, 19.3R3.
Description
The issue is related to an Incorrect Behavior Order vulnerability in the MAP-E automatic tunneling mechanism of Juniper Networks Junos OS. This vulnerability allows an attacker to send certain malformed IPv4 or IPv6 packets to cause a Denial of Service (DoS) to the PFE on the device, which is disabled as a result of the processing of these packets. Continued receipt and processing of these malformed packets will create a sustained Denial of Service (DoS) condition. The issue only affects MPC 7/8/9/10/11 cards when MAP-E IP reassembly is enabled on these cards. An indicator of compromise is the output: FPC ["FPC ID" # e.g. "0"] PFE #{PFE ID # e.g. "1"] : Fabric Disabled, which can be checked using the command: show chassis fabric fpcs.
Recommendations
For Juniper Networks Junos OS versions 17.2R1 and later versions, update to a version that includes the fix for this issue.
For Juniper Networks Junos OS versions 17.3 prior to 17.3R3-S9, update to version 17.3R3-S9 or later.
For Juniper Networks Junos OS versions 17.4 prior to 17.4R2-S12, 17.4R3-S3, update to version 17.4R2-S12 or 17.4R3-S3 or later.
For Juniper Networks Junos OS versions 18.1 prior to 18.1R3-S11, update to version 18.1R3-S11 or later.
For Juniper Networks Junos OS versions 18.2 prior to 18.2R2-S6, 18.2R3-S3, update to version 18.2R2-S6 or 18.2R3-S3 or later.
For Juniper Networks Junos OS versions 18.3 prior to 18.3R2-S4, 18.3R3-S1, update to version 18.3R2-S4 or 18.3R3-S1 or later.
For Juniper Networks Junos OS versions 18.4 prior to 18.4R1-S8, 18.4R2-S5, 18.4R3, update to version 18.4R1-S8 or 18.4R2-S5 or 18.4R3 or later.
For Juniper Networks Junos OS versions 19.1 prior to 19.1R1-S6, 19.1R2-S2, 19.1R3, update to version 19.1R1-S6 or 19.1R2-S2 or 19.1R3 or later.
For Juniper Networks Junos OS versions 19.2 prior to 19.2R1-S5, 19.2R2, update to version 19.2R1-S5 or 19.2R2 or later.
For Juniper Networks Junos OS versions 19.3 prior to 19.3R2-S5, 19.3R3, update to version 19.3R2-S5 or 19.3R3 or later.
As a temporary workaround, consider disabling the MAP-E IP reassembly on the affected MPC cards until a patch is available.
Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Junos