PT-2024-3167 · Juniper Networks · Junos+1

Published

2024-04-10

·

Updated

2024-05-16

·

CVE-2024-21618

CVSS v4.0

7.1

High

VectorAV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions: Junos OS versions 21.4 through 21.4R3-S4 Junos OS versions 22.1 through 22.1R3-S4 Junos OS versions 22.2 through 22.2R3-S2 Junos OS versions 22.3 through 22.3R2-S2, 22.3R3-S1 Junos OS versions 22.4 through 22.4R3 Junos OS versions 23.2 through 23.2R2 Junos OS Evolved versions 21.4-EVO through 21.4R3-S5-EVO Junos OS Evolved versions 22.1-EVO through 22.1R3-S4-EVO Junos OS Evolved versions 22.2-EVO through 22.2R3-S2-EVO Junos OS Evolved versions 22.3-EVO through 22.3R2-S2-EVO, 22.3R3-S1-EVO Junos OS Evolved versions 22.4-EVO through 22.4R3-EVO Junos OS Evolved versions 23.2-EVO through 23.2R2-EVO
Description: The issue is related to an Access of Memory Location After End of Buffer vulnerability in the Layer-2 Control Protocols Daemon (l2cpd) of Juniper Networks Junos OS and Junos OS Evolved. This vulnerability allows an adjacent, unauthenticated attacker to cause Denial of Service (DoS) when a malformed LLDP packet is received on an interface where LLDP is enabled. The impact includes the crash and restart of l2cpd, reinitialization of STP protocols (RSTP, MSTP, or VSTP), and MVRP and ERP, as well as affecting services that depend on LLDP state, such as PoE or VoIP device recognition.
Recommendations: For Junos OS versions 21.4 through 21.4R3-S4, update to version 21.4R3-S4 or later. For Junos OS versions 22.1 through 22.1R3-S4, update to version 22.1R3-S4 or later. For Junos OS versions 22.2 through 22.2R3-S2, update to version 22.2R3-S2 or later. For Junos OS versions 22.3 through 22.3R2-S2, 22.3R3-S1, update to version 22.3R2-S2, 22.3R3-S1 or later. For Junos OS versions 22.4 through 22.4R3, update to version 22.4R3 or later. For Junos OS versions 23.2 through 23.2R2, update to version 23.2R2 or later. For Junos OS Evolved versions 21.4-EVO through 21.4R3-S5-EVO, update to version 21.4R3-S5-EVO or later. For Junos OS Evolved versions 22.1-EVO through 22.1R3-S4-EVO, update to version 22.1R3-S4-EVO or later. For Junos OS Evolved versions 22.2-EVO through 22.2R3-S2-EVO, update to version 22.2R3-S2-EVO or later. For Junos OS Evolved versions 22.3-EVO through 22.3R2-S2-EVO, 22.3R3-S1-EVO, update to version 22.3R2-S2-EVO, 22.3R3-S1-EVO or later. For Junos OS Evolved versions 22.4-EVO through 22.4R3-EVO, update to version 22.4R3-EVO or later. For Junos OS Evolved versions 23.2-EVO through 23.2R2-EVO, update to version 23.2R2-EVO or later.

Fix

DoS

Out of bounds Read

Access of Memory Location After End of Buffer

Weakness Enumeration

CWE-125CWE-788

Related Identifiers

BDU:2024-03380
CVE-2024-21618

Affected Products

Junos
Junos Evolved