PT-2022-6701 · Juniper Networks · Junos+1

Published 2022-01-13 · Updated 2022-01-26 · CVE-2022-22177

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions 12.3 through 12.3R12-S20 Juniper Networks Junos OS versions 15.1 through 15.1R7-S11 Juniper Networks Junos OS versions 18.3 through 18.3R3-S6 Juniper Networks Junos OS versions 18.4 through 18.4R2-S9, 18.4R3-S10 Juniper Networks Junos OS versions 19.1 through 19.1R2-S3, 19.1R3-S7 Juniper Networks Junos OS versions 19.2 through 19.2R1-S8, 19.2R3-S4 Juniper Networks Junos OS versions 19.3 through 19.3R3-S4 Juniper Networks Junos OS versions 19.4 through 19.4R2-S5, 19.4R3-S6 Juniper Networks Junos OS versions 20.1 through 20.1R3-S2 Juniper Networks Junos OS versions 20.2 through 20.2R3-S3 Juniper Networks Junos OS versions 20.3 through 20.3R3-S1 Juniper Networks Junos OS versions 20.4 through 20.4R3 Juniper Networks Junos OS versions 21.1 through 21.1R2-S2, 21.1R3 Juniper Networks Junos OS versions 21.2 through 21.2R1-S2, 21.2R2 Juniper Networks Junos OS Evolved versions 21.2 through 21.2R3-EVO Juniper Networks Junos OS Evolved versions 21.3 through 21.3R2-EVO

Description A release of illegal memory vulnerability in the snmpd daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to halt the snmpd daemon, causing a sustained Denial of Service (DoS) to the service until it is manually restarted. This issue impacts any version of SNMP – v1, v2, v3.

Recommendations For Juniper Networks Junos OS versions 12.3 through 12.3R12-S20, update to version 12.3R12-S20 or later. For Juniper Networks Junos OS versions 15.1 through 15.1R7-S11, update to version 15.1R7-S11 or later. For Juniper Networks Junos OS versions 18.3 through 18.3R3-S6, update to version 18.3R3-S6 or later. For Juniper Networks Junos OS versions 18.4 through 18.4R2-S9, 18.4R3-S10, update to version 18.4R2-S9, 18.4R3-S10 or later. For Juniper Networks Junos OS versions 19.1 through 19.1R2-S3, 19.1R3-S7, update to version 19.1R2-S3, 19.1R3-S7 or later. For Juniper Networks Junos OS versions 19.2 through 19.2R1-S8, 19.2R3-S4, update to version 19.2R1-S8, 19.2R3-S4 or later. For Juniper Networks Junos OS versions 19.3 through 19.3R3-S4, update to version 19.3R3-S4 or later. For Juniper Networks Junos OS versions 19.4 through 19.4R2-S5, 19.4R3-S6, update to version 19.4R2-S5, 19.4R3-S6 or later. For Juniper Networks Junos OS versions 20.1 through 20.1R3-S2, update to version 20.1R3-S2 or later. For Juniper Networks Junos OS versions 20.2 through 20.2R3-S3, update to version 20.2R3-S3 or later. For Juniper Networks Junos OS versions 20.3 through 20.3R3-S1, update to version 20.3R3-S1 or later. For Juniper Networks Junos OS versions 20.4 through 20.4R3, update to version 20.4R3 or later. For Juniper Networks Junos OS versions 21.1 through 21.1R2-S2, 21.1R3, update to version 21.1R2-S2, 21.1R3 or later. For Juniper Networks Junos OS versions 21.2 through 21.2R1-S2, 21.2R2, update to version 21.2R1-S2, 21.2R2 or later. For Juniper Networks Junos OS Evolved versions 21.2 through 21.2R3-EVO, update to version 21.2R3-EVO or later. For Juniper Networks Junos OS Evolved versions 21.3 through 21.3R2-EVO, update to version 21.3R2-EVO or later.

Fix

DoS

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

BDU:2023-03537

CVE-2022-22177

Affected Products

Junos

Junos Evolved

References · 7

• https://juniper.net/documentation/us/en/software/junos/network-mgmt/topics/ref/statement/client-list-edit-snmp.html · Vendor Advisory
• https://kb.juniper.net/JSA11283 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22177 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22177 · Security Note
• https://bdu.fstec.ru/vul/2023-03537 · Security Note
• https://t.me/cibsecurity/35772 · Telegram Post
• https://vuldb.com/?id.190631 · Note