PT-2024-3307 · Juniper Networks · Junos+1

Published 2024-03-26 · Updated 2024-05-16 · CVE-2024-30382

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Junos OS versions prior to 20.4R3-S10 Junos OS versions 21.2 through 21.2R3-S7 Junos OS versions 21.3 through 21.3R2 Junos OS versions 21.4 through 21.4R2 Junos OS versions 22.1 through 22.1R1 Junos OS Evolved versions prior to 21.2R3-S8-EVO Junos OS Evolved versions 21.3 through 21.3R2-EVO Junos OS Evolved versions 21.4 through 21.4R2-EVO Junos OS Evolved versions 22.1 through 22.1R1-EVO

Description The issue is related to an Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. This vulnerability allows a network-based, unauthenticated attacker to send a specific routing update, causing an rpd core due to memory corruption, leading to a Denial of Service (DoS). The issue can only be triggered when the system is configured for CoS-based forwarding (CBF) with a policy map containing a cos-next-hop-map action.

Recommendations For Junos OS versions prior to 20.4R3-S10, update to version 20.4R3-S10 or later. For Junos OS versions 21.2 through 21.2R3-S7, update to version 21.2R3-S8 or later. For Junos OS versions 21.3 through 21.3R2, update to version 21.3R3 or later. For Junos OS versions 21.4 through 21.4R2, update to version 21.4R3 or later. For Junos OS versions 22.1 through 22.1R1, update to version 22.1R2 or later. For Junos OS Evolved versions prior to 21.2R3-S8-EVO, update to version 21.2R3-S8-EVO or later. For Junos OS Evolved versions 21.3 through 21.3R2-EVO, update to version 21.3R3-EVO or later. For Junos OS Evolved versions 21.4 through 21.4R2-EVO, update to version 21.4R3-EVO or later. For Junos OS Evolved versions 22.1 through 22.1R1-EVO, update to version 22.1R2-EVO or later.

Fix

DoS

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

BDU:2024-03541

CVE-2024-30382

Affected Products

Junos

Junos Evolved

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-30382 · Security Note
• https://bdu.fstec.ru/vul/2024-03541 · Security Note
• https://supportportal.juniper.net/JSA79174 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-30382 · Vendor Advisory
• https://t.me/cvenotify/80070 · Telegram Post
• https://t.me/cvenotify/80063 · Telegram Post
• https://first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L · Note
• https://vuldb.com/de/?id.260557 · Note