PT-2024-5565 · Juniper Networks · Junos Evolved

Published 2024-07-10 · Updated 2024-07-11 · CVE-2024-39531

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Junos OS Evolved on ACX 7000 Series versions prior to 21.4R3-S7-EVO Junos OS Evolved on ACX 7000 Series versions 22.1 prior to 22.1R3-S6-EVO Junos OS Evolved on ACX 7000 Series versions 22.2 prior to 22.2R3-S3-EVO Junos OS Evolved on ACX 7000 Series versions 22.3 prior to 22.3R3-S3-EVO Junos OS Evolved on ACX 7000 Series versions 22.4 prior to 22.4R3-S2-EVO Junos OS Evolved on ACX 7000 Series versions 23.2 prior to 23.2R2-EVO Junos OS Evolved on ACX 7000 Series versions 23.4 prior to 23.4R1-S1-EVO

Description The issue is related to an Improper Handling of Values vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX 7000 Series. This vulnerability allows a network-based, unauthenticated attacker to cause a Denial-of-Service (DoS). If a value is configured for DDoS bandwidth or burst parameters for any protocol in a queue, all protocols which share the same queue will have their bandwidth or burst value changed to the new value. This can inadvertently open the control plane to a high level of specific traffic or limit the bandwidth for a certain protocol, increasing the chances of a successful volumetric DoS attack.

Recommendations For versions prior to 21.4R3-S7-EVO, update to version 21.4R3-S7-EVO or later. For versions 22.1 prior to 22.1R3-S6-EVO, update to version 22.1R3-S6-EVO or later. For versions 22.2 prior to 22.2R3-S3-EVO, update to version 22.2R3-S3-EVO or later. For versions 22.3 prior to 22.3R3-S3-EVO, update to version 22.3R3-S3-EVO or later. For versions 22.4 prior to 22.4R3-S2-EVO, update to version 22.4R3-S2-EVO or later. For versions 23.2 prior to 23.2R2-EVO, update to version 23.2R2-EVO or later. For versions 23.4 prior to 23.4R1-S1-EVO, update to version 23.4R1-S1-EVO or later.

Fix

Weakness Enumeration

CWE-229

Related Identifiers

BDU:2024-06244

CVE-2024-39531

Affected Products

Junos Evolved

References · 7

• https://osv.dev/vulnerability/CVE-2024-39531 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06244 · Security Note
• https://supportportal.juniper.net/JSA82991 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39531 · Security Note
• https://twitter.com/CVEnew/status/1811440418304778446 · Twitter Post
• https://twitter.com/CveFindCom/status/1811483335597682793 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1811474274038747294 · Twitter Post