PT-2022-15280 · Juniper Networks · Junos

Published

2022-01-19

·

Updated

2022-01-26

·

CVE-2022-22176

CVSS v3.1

7.4

High

VectorAV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Junos OS versions 13.2R1 through 15.1R7-S10 Junos OS versions 18.3R1 through 18.3R3-S5 Junos OS versions 18.4R1 through 18.4R2-S8 Junos OS versions 18.4R3 through 18.4R3-S9 Junos OS versions 19.1R1 through 19.1R2-S2 Junos OS versions 19.1R3 through 19.1R3-S6 Junos OS versions 19.2R1 through 19.2R1-S7 Junos OS versions 19.2R3 through 19.2R3-S3 Junos OS versions 19.3R1 through 19.3R2-S6 Junos OS versions 19.3R3 through 19.3R3-S3 Junos OS versions 19.4R1 through 19.4R2 Junos OS versions 19.4R3 through 19.4R3-S5 Junos OS versions 20.1R1 through 20.1R2 Junos OS versions 20.1R3 through 20.1R3-S2 Junos OS versions 20.2R1 through 20.2R2 Junos OS versions 20.2R3 through 20.2R3-S2 Junos OS versions 20.3R1 through 20.3R2 Junos OS versions 20.3R3 through 20.3R3-S0 Junos OS versions 20.4R1 through 20.4R2 Junos OS versions 20.4R3 through 20.4R3-S0 Junos OS versions 21.1R1 through 21.1R1 Junos OS versions 21.1R2 through 21.1R2-S0 Junos OS versions 21.1R3 through 21.1R3-S0 Junos OS versions 21.2R1 through 21.2R1-S0 Junos OS versions 21.2R2 through 21.2R2-S0
Description An Improper Validation of Syntactic Correctness of Input issue in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS allows an adjacent unauthenticated attacker sending a malformed DHCP packet to cause a crash of jdhcpd and thereby a Denial of Service (DoS). If option-82 is configured in a DHCP snooping / -security scenario, jdhcpd crashes if a specific malformed DHCP request packet is received. The DHCP functionality is impacted while jdhcpd restarts, and continued exploitation of the issue will lead to the unavailability of the DHCP service and thereby a sustained DoS.
Recommendations For Junos OS versions 13.2R1 through 15.1R7-S10, update to version 15.1R7-S11 or later. For Junos OS versions 18.3R1 through 18.3R3-S5, update to version 18.3R3-S6 or later. For Junos OS versions 18.4R1 through 18.4R2-S8, update to version 18.4R2-S9 or later. For Junos OS versions 18.4R3 through 18.4R3-S9, update to version 18.4R3-S10 or later. For Junos OS versions 19.1R1 through 19.1R2-S2, update to version 19.1R2-S3 or later. For Junos OS versions 19.1R3 through 19.1R3-S6, update to version 19.1R3-S7 or later. For Junos OS versions 19.2R1 through 19.2R1-S7, update to version 19.2R1-S8 or later. For Junos OS versions 19.2R3 through 19.2R3-S3, update to version 19.2R3-S4 or later. For Junos OS versions 19.3R1 through 19.3R2-S6, update to version 19.3R2-S7 or later. For Junos OS versions 19.3R3 through 19.3R3-S3, update to version 19.3R3-S4 or later. For Junos OS versions 19.4R1 through 19.4R2, update to version 19.4R3 or later. For Junos OS versions 19.4R3 through 19.4R3-S5, update to version 19.4R3-S6 or later. For Junos OS versions 20.1R1 through 20.1R2, update to version 20.1R3 or later. For Junos OS versions 20.1R3 through 20.1R3-S2, update to version 20.1R3-S3 or later. For Junos OS versions 20.2R1 through 20.2R2, update to version 20.2R3 or later. For Junos OS versions 20.2R3 through 20.2R3-S2, update to version 20.2R3-S3 or later. For Junos OS versions 20.3R1 through 20.3R2, update to version 20.3R3 or later. For Junos OS versions 20.3R3 through 20.3R3-S0, update to version 20.3R3-S1 or later. For Junos OS versions 20.4R1 through 20.4R2, update to version 20.4R3 or later. For Junos OS versions 20.4R3 through 20.4R3-S0, update to version 20.4R3-S1 or later. For Junos OS versions 21.1R1 through 21.1R1, update to version 21.1R2 or later. For Junos OS versions 21.1R2 through 21.1R2-S0, update to version 21.1R2-S1 or later. For Junos OS versions 21.1R3 through 21.1R3-S0, update to version 21.1R3-S1 or later. For Junos OS versions 21.2R1 through 21.2R1-S0, update to version 21.2R1-S1 or later. For Junos OS versions 21.2R2 through 21.2R2-S0, update to version 21.2R2-S1 or later.

Fix

DoS

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-1286CWE-20

Related Identifiers

CVE-2022-22176

Affected Products

Junos