PT-2024-7136 · Juniper Networks · Junos Evolved

Published 2024-09-25 · Updated 2026-01-26 · CVE-2024-47502

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X

Name of the Vulnerable Software and Affected Versions Junos OS Evolved versions prior to 21.4R3-S9-EVO Junos OS Evolved versions 22.2 prior to 22.2R3-S4-EVO Junos OS Evolved version 22.4 prior to 22.4R3-S3-EVO Junos OS Evolved versions 23.2 prior to 23.2R2-S1-EVO Junos OS Evolved versions 23.4 prior to 23.4R2-EVO

Description The issue is related to an Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved, allowing an unauthenticated, network-based attacker to cause a Denial of Service (DoS). This occurs because the state of TCP sessions that are terminated is not cleared, leading to an exhaustion of resources over time and preventing new connections to the control plane from being established. The problem can be identified by a continuously increasing number of connections shown by the show system connections command. This issue only affects IPv4 and TCP sessions established in-band, but not out-of-band.

Recommendations For Junos OS Evolved versions prior to 21.4R3-S9-EVO, update to version 21.4R3-S9-EVO or later. For Junos OS Evolved versions 22.2 prior to 22.2R3-S4-EVO, update to version 22.2R3-S4-EVO or later. For Junos OS Evolved version 22.4 prior to 22.4R3-S3-EVO, update to version 22.4R3-S3-EVO or later. For Junos OS Evolved versions 23.2 prior to 23.2R2-S1-EVO, update to version 23.2R2-S1-EVO or later. For Junos OS Evolved versions 23.4 prior to 23.4R2-EVO, update to version 23.4R2-EVO or later. As a temporary workaround, consider restarting the respective RE manually to recover from the issue.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2024-08466

CVE-2024-47502

Affected Products

Junos Evolved

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-47502 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47502 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08466 · Security Note
• https://supportportal.juniper.net/JSA88132 · Vendor Advisory
• https://t.me/cveNotify/149904 · Telegram Post
• https://t.me/cvedetector/7707 · Telegram Post
• https://t.me/latest_high_impact_cve/1304 · Telegram Post
• https://twitter.com/cracbot/status/1846430965876642032 · Twitter Post
• https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-TCP-session-state-is-not-always-cleared-on-the-Routing-Engine-CVE-2024-47502?language=en_US · Note
• https://vuldb.com/?id.280067 · Note