PT-2024-7149 · Juniper Networks · Junos+1

Published 2024-09-25 · Updated 2026-01-26 · CVE-2024-47491

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 21.4R3-S8 Juniper Networks Junos OS versions from 22.2 before 22.2R3-S4 Juniper Networks Junos OS versions from 22.4 before 22.4R3-S3 Juniper Networks Junos OS versions from 23.2 before 23.2R2-S1 Juniper Networks Junos OS versions from 23.4 before 23.4R1-S2, 23.4R2 Juniper Networks Junos OS Evolved versions prior to 21.4R3-S8-EVO Juniper Networks Junos OS Evolved versions from 22.2 before 22.2R3-S4-EVO Juniper Networks Junos OS Evolved versions from 22.4 before 22.4R3-S3-EVO Juniper Networks Junos OS Evolved versions from 23.2 before 23.2R2-S1-EVO Juniper Networks Junos OS Evolved versions from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO

Description The issue is related to an Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. This vulnerability allows a network-based, unauthenticated attacker to cause Denial of Service (DoS) by sending a BGP UPDATE with a malformed path attribute over an established BGP session, causing the rpd to crash and restart. Continuous receipt of such a BGP UPDATE will create a sustained Denial of Service (DoS) condition for impacted devices. The probability of impact on 64-bit systems is extremely low.

Recommendations For Juniper Networks Junos OS versions prior to 21.4R3-S8, update to version 21.4R3-S8 or later. For Juniper Networks Junos OS versions from 22.2 before 22.2R3-S4, update to version 22.2R3-S4 or later. For Juniper Networks Junos OS versions from 22.4 before 22.4R3-S3, update to version 22.4R3-S3 or later. For Juniper Networks Junos OS versions from 23.2 before 23.2R2-S1, update to version 23.2R2-S1 or later. For Juniper Networks Junos OS versions from 23.4 before 23.4R1-S2, 23.4R2, update to version 23.4R1-S2 or later. For Juniper Networks Junos OS Evolved versions prior to 21.4R3-S8-EVO, update to version 21.4R3-S8-EVO or later. For Juniper Networks Junos OS Evolved versions from 22.2 before 22.2R3-S4-EVO, update to version 22.2R3-S4-EVO or later. For Juniper Networks Junos OS Evolved versions from 22.4 before 22.4R3-S3-EVO, update to version 22.4R3-S3-EVO or later. For Juniper Networks Junos OS Evolved versions from 23.2 before 23.2R2-S1-EVO, update to version 23.2R2-S1-EVO or later. For Juniper Networks Junos OS Evolved versions from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO, update to version 23.4R1-S2-EVO or later.

Fix

DoS

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

BDU:2024-08481

CVE-2024-47491

Affected Products

Junos

Junos Evolved

References · 18

• https://supportportal.juniper.net · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47491 · Security Note
• https://bdu.fstec.ru/vul/2024-08481 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47491 · Vendor Advisory
• https://twitter.com/cracbot/status/1846430960902148135 · Twitter Post
• https://t.me/cveNotify/149901 · Telegram Post
• https://twitter.com/transilienceai/status/1845331426402508963 · Twitter Post
• https://vuldb.com/?id.280091 · Note
• https://twitter.com/transilienceai/status/1845331412276105316 · Twitter Post
• https://twitter.com/transilienceai/status/1845331431108599897 · Twitter Post
• https://security-database.com/detail.php?alert=CVE-2024-47491 · Note
• https://twitter.com/transilienceai/status/1845331401559691439 · Twitter Post
• https://twitter.com/transilienceai/status/1845331447151796301 · Twitter Post
• https://twitter.com/transilienceai/status/1845331452541403208 · Twitter Post
• https://twitter.com/transilienceai/status/1845331441728516402 · Twitter Post