PT-2022-2766 · Juniper Networks · Junos

Published 2022-01-12 · Updated 2022-01-26 · CVE-2022-22175

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Junos OS versions prior to 20.4R3-S1 Junos OS versions prior to 21.1R2-S2, 21.1R3 Junos OS versions prior to 21.2R1-S2, 21.2R2 Junos OS versions prior to 21.3R1-S1, 21.3R2

Description An Improper Locking vulnerability in the SIP ALG of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause a flowprocessing daemon crash and thereby a Denial of Service. This issue occurs when the SIP ALG is enabled and specific SIP messages are being processed simultaneously. Continued receipt of these specific packets will cause a sustained Denial of Service condition.

Recommendations For Junos OS versions prior to 20.4R3-S1, update to 20.4R3-S1 or later. For Junos OS versions prior to 21.1R2-S2, 21.1R3, update to 21.1R2-S2, 21.1R3 or later. For Junos OS versions prior to 21.2R1-S2, 21.2R2, update to 21.2R1-S2, 21.2R2 or later. For Junos OS versions prior to 21.3R1-S1, 21.3R2, update to 21.3R1-S1, 21.3R2 or later.

Fix

DoS

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

BDU:2022-03286

CVE-2022-22175

Affected Products

Junos

References · 6

• https://kb.juniper.net/JSA11281 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03286 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22175 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22175 · Vendor Advisory
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA11281&cat=SIRT_1&actp=LIST · Note
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA11281&cat=SIRT_1&actp=LIST · Note