PT-2024-7137 · Juniper Networks · Junos Evolved

Published 2024-09-25 · Updated 2026-01-26 · CVE-2024-47489

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Junos OS Evolved versions prior to 21.4R3-S8-EVO Junos OS Evolved versions from 22.2 before 22.2R3-S4-EVO Junos OS Evolved versions from 22.3 before 22.3R3-S4-EVO Junos OS Evolved versions from 22.4 before 22.4R3-S3-EVO Junos OS Evolved versions from 23.2 before 23.2R2-EVO Junos OS Evolved versions from 23.4 before 23.4R1-S1-EVO, 23.4R2-EVO Junos OS Evolved versions from 24.2 before 24.2R2-EVO

Description An Improper Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS Evolved on ACX Series devices allows an unauthenticated, network-based attacker sending specific transit protocol traffic to cause a partial Denial of Service (DoS) to downstream devices. Receipt of specific transit protocol packets is incorrectly processed by the Routing Engine (RE), filling up the DDoS protection queue which is shared between routing protocols. This influx of transit protocol packets causes DDoS protection violations, resulting in protocol flaps which can affect connectivity to networking devices. This issue affects both IPv4 and IPv6 and does not require any specific routing protocol to be configured or enabled.

Recommendations For versions prior to 21.4R3-S8-EVO, update to version 21.4R3-S8-EVO or later. For versions from 22.2 before 22.2R3-S4-EVO, update to version 22.2R3-S4-EVO or later. For versions from 22.3 before 22.3R3-S4-EVO, update to version 22.3R3-S4-EVO or later. For versions from 22.4 before 22.4R3-S3-EVO, update to version 22.4R3-S3-EVO or later. For versions from 23.2 before 23.2R2-EVO, update to version 23.2R2-EVO or later. For versions from 23.4 before 23.4R1-S1-EVO, 23.4R2-EVO, update to version 23.4R1-S1-EVO, 23.4R2-EVO or later. For versions from 24.2 before 24.2R2-EVO, update to version 24.2R2-EVO or later. As a temporary workaround, consider monitoring the DDoS protection queue using the commands "show evo-pfemand host pkt-stats" and "show host-path ddos all-policers" to detect potential issues.

Fix

DoS

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

BDU:2024-08467

CVE-2024-47489

Affected Products

Junos Evolved

References · 14

• https://bdu.fstec.ru/vul/2024-08467 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47489 · Security Note
• https://supportportal.juniper.net · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47489 · Vendor Advisory
• https://twitter.com/transilienceai/status/1845331354751222187 · Twitter Post
• https://t.me/cveNotify/149899 · Telegram Post
• https://twitter.com/transilienceai/status/1845331322341826882 · Twitter Post
• https://twitter.com/transilienceai/status/1845331327484051505 · Twitter Post
• https://twitter.com/transilienceai/status/1845331313462501482 · Twitter Post
• https://twitter.com/transilienceai/status/1845331345062436933 · Twitter Post
• https://vuldb.com/?id.280090 · Note
• https://twitter.com/transilienceai/status/1845331340767404403 · Twitter Post
• https://twitter.com/transilienceai/status/1845331332647325946 · Twitter Post
• https://security-database.com/detail.php?alert=CVE-2024-47489 · Note