QID 44192

QID 44192: Juniper Network Operating System (Junos OS) Loopback Interface Bypass Vulnerability (JSA79100)

Juniper Junos is the network operating system used in Juniper Networks hardware systems.

CVE-2024-30410:An Incorrect Behavior Order in the routing engine (RE) of Juniper Networks Junos OS on EX4300 Series allows traffic intended to the device to reach the RE instead of being discarded when the discard term is set in loopback (lo0) interface. The intended function is that the lo0 firewall filter takes precedence over the revenue interface (ex. ge-0/0/0) firewall filter.

This issue affects versions of Junos OS:
All versions before 20.4R3-S10
21.2 to prior to 21.2R3-S7
21.4 to prior to 21.4R3-S6

QID detection logic: (Authenticated)
It checks for vulnerable Junos OS versions.

Note: This issue affects Junos OS device with IPv6 firewall filter configured for both lo0 interface and revenue interface (ex- ge-0/0/0): Note: This QID is marked as potential as the detection doesn't check for the workaround mentioned by the vendor.

This vulnerability may allows traffic intended to the device to reach the RE instead of being discarded when the discard term is set in loopback (lo0) interface.

CVSS V3 rated as Medium - 5.8 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

Vendor has released patch addressing the vulnerabilities, for more information please refer JSA79100

Workaround:
When lo0 filter is applied before the revenue interface (ex. ge-0/0/0) filter this issue could be avoided.

Vendor References

JSA79100 - supportportal.juniper.net/JSA79100

CVEs related to QID 44192

CVE-2024-30410 |

Software Advisories

Advisory ID	Software	Component	Link
JSA79100			supportportal.juniper.net/JSA79100

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].