PT-2022-6115 · Juniper Networks · Junos+1

Published 2022-07-13 · Updated 2022-07-30 · CVE-2022-22213

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 21.1R3-S1 Juniper Networks Junos OS versions prior to 21.2R2-S2, 21.2R3 Juniper Networks Junos OS versions prior to 21.3R2, 21.3R3 Juniper Networks Junos OS versions prior to 21.4R1-S1, 21.4R2 Juniper Networks Junos OS Evolved versions prior to 21.1R3-S1-EVO Juniper Networks Junos OS Evolved version 21.2R1-EVO and later versions Juniper Networks Junos OS Evolved versions prior to 21.3R3-EVO Juniper Networks Junos OS Evolved versions prior to 21.4R1-S1-EVO, 21.4R2-EVO

Description A vulnerability in the routing protocol daemon (RPD) process of Juniper Networks Junos OS and Junos OS Evolved may allow an unauthenticated network-based attacker to crash the RPD process by sending a specific BGP update while the system is under heavy load, leading to a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. Malicious exploitation of this issue requires a very specific combination of load, timing, and configuration of the vulnerable system which is beyond the direct control of the attacker. Systems are only vulnerable to this issue if BGP multipath is enabled. Routers not configured for BGP multipath are not vulnerable to this issue.

Recommendations For Juniper Networks Junos OS versions prior to 21.1R3-S1, update to version 21.1R3-S1 or later. For Juniper Networks Junos OS versions prior to 21.2R2-S2, 21.2R3, update to version 21.2R2-S2 or later. For Juniper Networks Junos OS versions prior to 21.3R2, 21.3R3, update to version 21.3R2 or later. For Juniper Networks Junos OS versions prior to 21.4R1-S1, 21.4R2, update to version 21.4R1-S1 or later. For Juniper Networks Junos OS Evolved versions prior to 21.1R3-S1-EVO, update to version 21.1R3-S1-EVO or later. For Juniper Networks Junos OS Evolved version 21.2R1-EVO and later versions, no specific update is provided, but consider disabling BGP multipath as a temporary workaround. For Juniper Networks Junos OS Evolved versions prior to 21.3R3-EVO, update to version 21.3R3-EVO or later. For Juniper Networks Junos OS Evolved versions prior to 21.4R1-S1-EVO, 21.4R2-EVO, update to version 21.4R1-S1-EVO or later.

Fix

DoS

Weakness Enumeration

CWE-232

Related Identifiers

BDU:2023-00055

CVE-2022-22213

Affected Products

Junos

Junos Evolved

References · 6

• https://kb.juniper.net/JSA69717 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22213 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22213 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00055 · Security Note
• https://t.me/cibsecurity/46668 · Telegram Post
• https://t.me/cvenotify/34027 · Telegram Post