QID 44026
Date Published: 2023-04-26
QID 44026: Juniper Network Operating System (Junos OS) Denial of Service (DoS) Vulnerability (JSA70607)
An Improper Input Validation vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS).
Affected Junos versions:
Juniper Networks Junos OS
20.3 versions prior to 20.3R3-S5;
20.4 versions prior to 20.4R3-S3;
21.1 versions prior to 21.1R3-S4;
21.2 versions prior to 21.2R3;
21.3 versions prior to 21.3R3;
21.4 versions prior to 21.4R2;
22.1 versions prior to 22.1R2.
Affected series :- NFX-Series, Virtual SRX, SRX-Series Branch, SRX-Series HE, EX-Series, QFX-Series, ACX, MX-Series, PTX-Series
QID detection logic: (Authenticated)
It checks for vulnerable Junos OS version.
Note: This QID does not checks for EVO version hence set to practice.
Successful exploitation allows a allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS).
Workaround:
If the receipt of router advertisements is not necessary (but just the solicited or unsolicited sending of RAs) then incoming RAs can be filtered and dropped by applying a firewall filter like the following:
set firewall family inet6 filter test term 1 from next-header icmp6
set firewall family inet6 filter test term 1 from icmp-type 134
set firewall family inet6 filter test term 1 then discard
set firewall family inet6 filter test term 2 then accept
- JSA70607 -
kb.juniper.net/JSA70607
CVEs related to QID 44026
| Advisory ID | Software | Component | Link |
|---|---|---|---|
| JSA70607 |
kb.juniper.net/JSA70607 |