PT-2023-6155 · Juniper Networks · Junos Evolved+1
Published
2023-06-27
·
Updated
2023-10-16
·
CVE-2023-36839
CVSS v3.1
6.5
Medium
| Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Juniper Networks Junos OS versions prior to 20.4R3-S8
Juniper Networks Junos OS versions 21.1R1 and later versions
Juniper Networks Junos OS versions prior to 21.2R3-S5
Juniper Networks Junos OS versions prior to 21.3R3-S4
Juniper Networks Junos OS versions prior to 21.4R3-S3
Juniper Networks Junos OS versions prior to 22.1R3-S2
Juniper Networks Junos OS versions prior to 22.2R3
Juniper Networks Junos OS versions prior to 22.3R2-S2
Juniper Networks Junos OS versions prior to 22.4R2
Juniper Networks Junos OS Evolved versions prior to 20.4R3-S8-EVO
Juniper Networks Junos OS Evolved versions 21.1R1-EVO and later versions
Juniper Networks Junos OS Evolved versions prior to 21.2R3-S5-EVO
Juniper Networks Junos OS Evolved versions prior to 21.3R3-S4-EVO
Juniper Networks Junos OS Evolved versions prior to 21.4R3-S3-EVO
Juniper Networks Junos OS Evolved versions prior to 22.1R3-S2-EVO
Juniper Networks Junos OS Evolved versions prior to 22.2R3-EVO
Juniper Networks Junos OS Evolved versions prior to 22.3R2-S2-EVO
Juniper Networks Junos OS Evolved versions prior to 22.4R1-S1-EVO
Description
The issue is related to an Improper Validation of Specified Quantity in Input vulnerability in the Layer-2 control protocols daemon (l2cpd) of Juniper Networks Junos OS and Junos OS Evolved. This vulnerability allows an unauthenticated adjacent attacker who sends specific LLDP packets to cause a Denial of Service (DoS). The impact of the l2cpd crash is reinitialization of STP protocols (RSTP, MSTP or VSTP), and MVRP and ERP. Also, if any services depend on LLDP state (like PoE or VoIP device recognition), then these will also be affected.
Recommendations
For Juniper Networks Junos OS versions prior to 20.4R3-S8, update to version 20.4R3-S8 or later.
For Juniper Networks Junos OS versions 21.1R1 and later versions, update to version 21.2R3-S5 or later.
For Juniper Networks Junos OS versions prior to 21.2R3-S5, update to version 21.2R3-S5 or later.
For Juniper Networks Junos OS versions prior to 21.3R3-S4, update to version 21.3R3-S4 or later.
For Juniper Networks Junos OS versions prior to 21.4R3-S3, update to version 21.4R3-S3 or later.
For Juniper Networks Junos OS versions prior to 22.1R3-S2, update to version 22.1R3-S2 or later.
For Juniper Networks Junos OS versions prior to 22.2R3, update to version 22.2R3 or later.
For Juniper Networks Junos OS versions prior to 22.3R2-S2, update to version 22.3R2-S2 or later.
For Juniper Networks Junos OS versions prior to 22.4R2, update to version 22.4R2 or later.
For Juniper Networks Junos OS Evolved versions prior to 20.4R3-S8-EVO, update to version 20.4R3-S8-EVO or later.
For Juniper Networks Junos OS Evolved versions 21.1R1-EVO and later versions, update to version 21.2R3-S5-EVO or later.
For Juniper Networks Junos OS Evolved versions prior to 21.2R3-S5-EVO, update to version 21.2R3-S5-EVO or later.
For Juniper Networks Junos OS Evolved versions prior to 21.3R3-S4-EVO, update to version 21.3R3-S4-EVO or later.
For Juniper Networks Junos OS Evolved versions prior to 21.4R3-S3-EVO, update to version 21.4R3-S3-EVO or later.
For Juniper Networks Junos OS Evolved versions prior to 22.1R3-S2-EVO, update to version 22.1R3-S2-EVO or later.
For Juniper Networks Junos OS Evolved versions prior to 22.2R3-EVO, update to version 22.2R3-EVO or later.
For Juniper Networks Junos OS Evolved versions prior to 22.3R2-S2-EVO, update to version 22.3R2-S2-EVO or later.
For Juniper Networks Junos OS Evolved versions prior to 22.4R1-S1-EVO, update to version 22.4R1-S1-EVO or later.
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Junos
Junos Evolved