PT-2024-1129 · Juniper Networks · Junos

Published 2024-01-10 · Updated 2024-01-19 · CVE-2024-21600

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 20.4R3-S8 Juniper Networks Junos OS 21.1 versions prior to 21.1R3-S4 Juniper Networks Junos OS 21.2 versions prior to 21.2R3-S6 Juniper Networks Junos OS 21.3 versions prior to 21.3R3-S3 Juniper Networks Junos OS 21.4 versions prior to 21.4R3-S5 Juniper Networks Junos OS 22.1 versions prior to 22.1R2-S2, 22.1R3 Juniper Networks Junos OS 22.2 versions prior to 22.2R2-S1, 22.2R3

Description An Improper Neutralization of Equivalent Special Elements vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on PTX Series allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). When MPLS packets are meant to be sent to a flexible tunnel interface (FTI) and if the FTI tunnel is down, these will hit the reject NH, due to which the packets get sent to the CPU and cause a host path wedge condition. This will cause the FPC to hang and requires a manual restart to recover. The issue specifically affects PTX1000, PTX3000, PTX5000 with FPC3, PTX10002-60C, and PTX10008/16 with LC110x.

Recommendations For Juniper Networks Junos OS versions prior to 20.4R3-S8, update to version 20.4R3-S8 or later. For Juniper Networks Junos OS 21.1 versions prior to 21.1R3-S4, update to version 21.1R3-S4 or later. For Juniper Networks Junos OS 21.2 versions prior to 21.2R3-S6, update to version 21.2R3-S6 or later. For Juniper Networks Junos OS 21.3 versions prior to 21.3R3-S3, update to version 21.3R3-S3 or later. For Juniper Networks Junos OS 21.4 versions prior to 21.4R3-S5, update to version 21.4R3-S5 or later. For Juniper Networks Junos OS 22.1 versions prior to 22.1R2-S2, 22.1R3, update to version 22.1R2-S2 or later. For Juniper Networks Junos OS 22.2 versions prior to 22.2R2-S1, 22.2R3, update to version 22.2R2-S1 or later.

Fix

DoS

Weakness Enumeration

CWE-76

Related Identifiers

BDU:2024-00442

CVE-2024-21600

Affected Products

Junos

References · 8

• https://osv.dev/vulnerability/CVE-2024-21600 · Vendor Advisory
• https://supportportal.juniper.net/JSA75741 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00442 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21600 · Security Note
• https://cybersecurity-help.cz/vdb/SB2024011070 · Note
• https://vuldb.com/it/?id.250518 · Note
• https://twitter.com/VulmonFeeds/status/1745756959645610328 · Twitter Post
• https://first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L · Note