PT-2024-1128 · Juniper Networks · Junos

Published 2024-01-10 · Updated 2024-01-19 · CVE-2024-21601

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Junos OS versions prior to 21.2R3-S5 Junos OS versions prior to 21.3R3-S5 Junos OS versions prior to 21.4R3-S4 Junos OS versions prior to 22.1R3-S3 Junos OS versions prior to 22.2R3-S1 Junos OS versions prior to 22.3R2-S2, 22.3R3 Junos OS versions prior to 22.4R2-S1, 22.4R3

Description A Concurrent Execution using Shared Resource with Improper Synchronization issue in the Flow-processing Daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service. When two different threads try to simultaneously process a queue used for TCP events, flowd will crash. Continued exploitation of this issue will lead to a sustained DoS.

Recommendations For versions 21.2, update to 21.2R3-S5 or later. For versions 21.3, update to 21.3R3-S5 or later. For versions 21.4, update to 21.4R3-S4 or later. For versions 22.1, update to 22.1R3-S3 or later. For versions 22.2, update to 22.2R3-S1 or later. For versions 22.3, update to 22.3R2-S2, 22.3R3 or later. For versions 22.4, update to 22.4R2-S1, 22.4R3 or later.

Fix

DoS

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BDU:2024-00441

CVE-2024-21601

Affected Products

Junos

References · 7

• https://supportportal.juniper.net/JSA75742 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00441 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21601 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21601 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2024011220 · Note
• https://vuldb.com/it/?id.250509 · Note
• https://first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L · Note