PT-2022-1467 · Juniper Networks · Junos

Published 2022-01-12 · Updated 2022-01-28 · CVE-2022-22160

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions 16.1R1 through 18.4R3-S10 Juniper Networks Junos OS versions 19.1 through 19.1R2-S3 Juniper Networks Junos OS versions 19.1 through 19.1R3-S7 Juniper Networks Junos OS versions 19.2 through 19.2R1-S8 Juniper Networks Junos OS versions 19.2 through 19.2R3-S4 Juniper Networks Junos OS versions 19.3 through 19.3R3-S4 Juniper Networks Junos OS versions 19.4 through 19.4R3-S5 Juniper Networks Junos OS versions 20.1 through 20.1R3-S3 Juniper Networks Junos OS versions 20.2 through 20.2R3-S3 Juniper Networks Junos OS versions 20.3 through 20.3R3-S2 Juniper Networks Junos OS versions 20.4 through 20.4R3 Juniper Networks Junos OS versions 21.1 through 21.1R3 Juniper Networks Junos OS versions 21.2 through 21.2R2

Description The issue is related to an Unchecked Error Condition vulnerability in the subscriber management daemon (smgd) of Juniper Networks Junos OS, which allows an unauthenticated adjacent attacker to cause a crash and thereby a Denial of Service (DoS). This occurs when a single session group configuration contains dual-stack and a pp0 interface, and a PPPoE client sends a specific message, causing smgd to crash and restart.

Recommendations For Juniper Networks Junos OS versions 16.1R1 through 18.4R3-S10, update to version 18.4R3-S10 or later. For Juniper Networks Junos OS versions 19.1 through 19.1R2-S3, update to version 19.1R2-S3 or later. For Juniper Networks Junos OS versions 19.1 through 19.1R3-S7, update to version 19.1R3-S7 or later. For Juniper Networks Junos OS versions 19.2 through 19.2R1-S8, update to version 19.2R1-S8 or later. For Juniper Networks Junos OS versions 19.2 through 19.2R3-S4, update to version 19.2R3-S4 or later. For Juniper Networks Junos OS versions 19.3 through 19.3R3-S4, update to version 19.3R3-S4 or later. For Juniper Networks Junos OS versions 19.4 through 19.4R3-S5, update to version 19.4R3-S5 or later. For Juniper Networks Junos OS versions 20.1 through 20.1R3-S3, update to version 20.1R3-S3 or later. For Juniper Networks Junos OS versions 20.2 through 20.2R3-S3, update to version 20.2R3-S3 or later. For Juniper Networks Junos OS versions 20.3 through 20.3R3-S2, update to version 20.3R3-S2 or later. For Juniper Networks Junos OS versions 20.4 through 20.4R3, update to version 20.4R3 or later. For Juniper Networks Junos OS versions 21.1 through 21.1R3, update to version 21.1R3 or later. For Juniper Networks Junos OS versions 21.2 through 21.2R2, update to version 21.2R2 or later.

Fix

DoS

Weakness Enumeration

CWE-391

Related Identifiers

BDU:2022-00609

CVE-2022-22160

Affected Products

Junos

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-22160 · Security Note
• https://bdu.fstec.ru/vul/2022-00609 · Security Note
• https://kb.juniper.net/JSA11268 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22160 · Vendor Advisory
• https://t.me/cibsecurity/35769 · Telegram Post
• https://t.me/cvenotify/25970 · Telegram Post