PT-2024-8884 · Juniper Networks · Junos

Published 2024-07-10 · Updated 2024-07-11 · CVE-2024-39551

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions 20.4 through 20.4R3-S10 Juniper Networks Junos OS versions 21.2 through 21.2R3-S6 Juniper Networks Junos OS versions 21.3 through 21.3R3-S5 Juniper Networks Junos OS versions 21.4 through 21.4R3-S6 Juniper Networks Junos OS versions 22.1 through 22.1R3-S4 Juniper Networks Junos OS versions 22.2 through 22.2R3-S2 Juniper Networks Junos OS versions 22.3 through 22.3R3-S1 Juniper Networks Junos OS versions 22.4 through 22.4R3 Juniper Networks Junos OS versions 23.2 through 23.2R2

Description: The issue is related to an Uncontrolled Resource Consumption vulnerability in the H.323 Application Layer Gateway (ALG) of Juniper Networks Junos OS on SRX Series and MX Series with SPC3 and MS-MPC/MIC. This vulnerability allows an unauthenticated network-based attacker to send specific packets, causing traffic loss and leading to a Denial of Service (DoS) condition. Continued receipt and processing of these specific packets will sustain the Denial of Service condition. The memory usage can be monitored using the command show usp memory segment sha data objcache jsf.

Recommendations: Update to version 20.4R3-S10 or later for versions 20.4 through 20.4R3-S10 Update to version 21.2R3-S6 or later for versions 21.2 through 21.2R3-S6 Update to version 21.3R3-S5 or later for versions 21.3 through 21.3R3-S5 Update to version 21.4R3-S6 or later for versions 21.4 through 21.4R3-S6 Update to version 22.1R3-S4 or later for versions 22.1 through 22.1R3-S4 Update to version 22.2R3-S2 or later for versions 22.2 through 22.2R3-S2 Update to version 22.3R3-S1 or later for versions 22.3 through 22.3R3-S1 Update to version 22.4R3 or later for versions 22.4 through 22.4R3 Update to version 23.2R2 or later for versions 23.2 through 23.2R2

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2024-10551

CVE-2024-39551

Affected Products

Junos

References · 11

• https://osv.dev/vulnerability/CVE-2024-39551 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10551 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-39551 · Security Note
• https://supportportal.juniper.net/JSA83013 · Vendor Advisory
• https://vulners.com/cve/CVE-2024-39551 · Note
• https://t.me/cvedetector/680 · Telegram Post
• https://vuldb.com/?id.271170 · Note
• https://twitter.com/CveFindCom/status/1811453422182207866 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1811472756845801934 · Twitter Post
• https://supportportal.juniper.net/s/article/2024-07-Security-Bulletin-Junos-OS-SRX-Series-and-MX-Series-with-SPC3-and-MS-MPC-MIC-Receipt-of-specific-packets-in-H-323-ALG-causes-traffic-drop-CVE-2024-39551?language=en_US · Note
• https://twitter.com/CVEnew/status/1811440398956458109 · Twitter Post