exploitintel/cve-cwe-consensus huggingface dataset:
user: An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system.

The Junos OS Evolved CLI doesn't properly handle command options in some cases, allowing users which execute specific CLI commands with a crafted set of parameters to escalate their privileges to root on shell level.

This issue affects Junos OS Evolved:

All versions before 20.4R3-S7-EVO,

21.2-EVO versions before 21.2R3-S8-EVO,

21.4-EVO versions before 21.4R3-S7-EVO, 

22.2-EVO versions before 22.2R3-EVO,

22.3-EVO versions before 22.3R2-EVO,

22.4-EVO versions before 22.4R2-EVO.

assistant: CWE-78
user: An Improper Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS on MX Series with MPC10/MPC11/LC9600 line cards, EX9200 with EX9200-15C lines cards, MX304 devices, and Juniper Networks Junos OS Evolved on PTX Series, allows an attacker sending malformed DHCP packets to cause ingress packet processing to stop, leading to a Denial of Service (DoS).  Continued receipt and processing of these packets will create a sustained Denial of Service (DoS) condition.

This issue only occurs if DHCP snooping is enabled. See configuration below.

This issue can be detected using following commands. Their output will display the interface status going down:


user@device>show interfaces <if--x/x/x>
user@device>show log messages | match <if--x/x/x>
user@device>show log messages ==> will display the "[Error] Wedge-Detect : Host Loopback Wedge Detected: PFE: no," logs.

This issue affects:
Junos OS on 

MX Series 

with MPC10/MPC11/LC9600 line cards, EX9200 with EX9200-15C line cards, and MX304: 


  *  All versions before 21.2R3-S7, 
  *  from 21.4 before 21.4R3-S6, 
  *  from 22.2 before 22.2R3-S3, 
  *  all versions of 22.3,
  *  from 22.4 before 22.4R3, 
  *  from 23.2 before 23.2R2; 



Junos OS Evolved on PTX Series: 
  *  from 19.3R1-EVO before 21.2R3-S8-EVO,

  *  from 21.4-EVO before 21.4R3-S7-EVO, 
  *  from 22.1-EVO before 22.1R3-S6-EVO, 
  *  from 22.2-EVO before 22.2R3-S5-EVO, 
  *  from 22.3-EVO before 22.3R3-S3-EVO, 
  *  from 22.4-EVO before 22.4R3-S1-EVO, 
  *  from 23.2-EVO before 23.2R2-S2-EVO, 
  *  from 23.4-EVO before 23.4R2-EVO.



Junos OS Evolved releases prior to 19.3R1-EVO are unaffected by this vulnerability

assistant: CWE-755
user: A Use After Free vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to cause a Denial of Service (DoS).On all Junos OS and Junos Evolved platforms, if a routing-instance deactivation is triggered, and at the same time a specific SNMP request is received, a segmentation fault occurs which causes rpd to crash and restart.




This issue affects:

   Junos OS:



  *  All versions before 21.2R3-S8, 
  *  21.4 versions before 21.4R3-S5,
  *  22.2 versions before 22.2R3-S3,
  *  22.3 versions before 22.3R3-S2,
  *  22.4 versions before 22.4R3,
  *  23.2 versions before 23.2R2.




   Junos OS Evolved:



  *  All versions before 21.2R3-S8-EVO,
  *  21.4-EVO versions before 21.4R3-S5-EVO,
  *  22.2-EVO versions before 22.2R3-S3-EVO, 
  *  22.3-EVO versions before 22.3R3-S2-EVO,
  *  22.4-EVO versions before 22.4R3-EVO,
  *  23.2-EVO versions before 23.2R2-EVO.

assistant: CWE-416
user: A Use of Externally-Controlled Format String vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).



If DNS Domain Generation Algorithm (DGA) detection or tunnel detection, and DNS-filtering traceoptions are configured, and specific valid transit DNS traffic is received this causes a PFE crash and restart, leading to a Denial of Service.

This issue affects Junos OS: 
  *  All versions before 21.4R3-S6,
  *  22.2 versions before 22.2R3-S3,
  *  22.3 versions before 22.3R3-S3,
  *  22.4 versions before 22.4R3,
  *  23.2 versions before 23.2R2.

assistant: CWE-134
user: An Improper Check for Unusual or Exceptional Conditions vulnerability in the chassis management daemon (chassisd) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause a 

Denial-of-Service (DoS).

If an attempt is made to access specific sensors on platforms not supporting these sensors, either via GRPC or netconf, chassisd will crash and restart leading to a restart of all FPCs and thereby a complete outage.

This issue affects Junos OS:



  *  21.4 versions from 21.4R3 before 21.4R3-S5,
  *  22.1 versions from 22.1R3 before 22.1R3-S4,
  *  22.2 versions from 22.2R2 before 22.2R3,
  *  22.3 versions from 22.3R1 before 22.3R2-S2, 22.3R3,
  *  22.4 versions from 22.4R1 before 22.4R2.


This issue does not affect Junos OS versions earlier than 21.4.

assistant: CWE-754
user: An Incorrect Comparison vulnerability in the local address verification API of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent attacker to create sessions or send traffic to the device using the network and broadcast address of the subnet assigned to an interface. This is unintended and unexpected behavior and can allow an attacker to bypass certain compensating controls, such as stateless firewall filters.

This issue affects Junos OS Evolved: 



  *  All versions before 21.4R3-S8-EVO, 
  *  22.2-EVO before 22.2R3-S4-EVO, 
  *  22.3-EVO before 22.3R3-S4-EVO, 
  *  22.4-EVO before 22.4R3-S3-EVO, 
  *  23.2-EVO before 23.2R2-S1-EVO, 
  *  23.4-EVO before 23.4R1-S2-EVO, 23.4R2-EVO.

assistant: CWE-697
user: A Missing Release of Memory after Effective Lifetime vulnerability in the Periodic Packet Management Daemon (ppmd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a 

Denial-of-Service (DoS).


When a BFD session configured with authentication flaps, ppmd memory can leak. Whether the leak happens depends on a race condition which is outside the attackers control. This issue only affects BFD operating in distributed aka delegated (which is the default behavior) or inline mode.



Whether the leak occurs can be monitored with the following CLI command:

> show ppm request-queue


FPC     Pending-request
fpc0                   2
request-total-pending: 2


where a continuously increasing number of pending requests is indicative of the leak. 








This issue affects:

Junos OS:


  *  All versions before 21.2R3-S8,
  *  21.4 versions before 21.4R3-S7,
  *  22.1 versions before 22.1R3-S4,
  *  22.2 versions before 22.2R3-S4, 
  *  22.3 versions before 22.3R3,
  *  22.4 versions before 22.4R2-S2, 22.4R3.



Junos OS Evolved:
  *  All versions before 21.2R3-S8-EVO,
  *  21.4-EVO versions before 21.4R3-S7-EVO,
  *  22.2-EVO versions before 22.2R3-S4-EVO,
  *  22.3-EVO versions before 22.3R3-EVO,
  *  22.4-EVO versions before 22.4R3-EVO.

assistant: CWE-401
user: A Buffer Copy without Checking Size of Input vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved on ACX7000 Series allows an unauthenticated, adjacent attacker to cause a 

Denial-of-Service (DoS).When multicast traffic with a specific, valid (S,G) is received, evo-pfemand crashes which leads to an outage of the affected FPC until it is manually recovered.


This issue affects Junos OS Evolved on ACX7000 Series:


  *  All versions before 21.2R3-S8-EVO,
  *  21.4-EVO versions before 21.4R3-S7-EVO,
  *  22.2-EVO versions before 22.2R3-S4-EVO,
  *  22.3-EVO versions before 22.3R3-S3-EVO, 
  *  22.4-EVO versions before 22.4R3-S2-EVO, 
  *  23.2-EVO versions before 23.2R2-EVO, 
  *  23.4-EVO versions before 23.4R1-S2-EVO, 23.4R2-EVO.

assistant: CWE-120
user: A Missing Release of Memory after Effective Lifetime vulnerability in Juniper Networks Junos OS on MX Series allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS).

In a subscriber management scenario continuous subscriber logins will trigger a memory leak and eventually lead to an FPC crash and restart.

This issue affects Junos OS on MX Series:



  *  All version before 21.2R3-S6,
  *  21.4 versions before 21.4R3-S6,
  *  22.1 versions before 22.1R3-S5,
  *  22.2 versions before 22.2R3-S3, 
  *  22.3 versions before 22.3R3-S2,
  *  22.4 versions before 22.4R3,
  *  23.2 versions before 23.2R2.

assistant: CWE-401
user: An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on SRX Series, and MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

When an affected device receives specific valid TCP traffic, the pfe crashes and restarts leading to a momentary but complete service outage.

This issue affects Junos OS:

21.2 releases from 21.2R3-S5 before 21.2R3-S6.

This issue does not affect earlier or later releases.

assistant: CWE-754
user: An Incorrect Default Permissions vulnerability in the command line interface (CLI) of Juniper Networks Junos OS Evolved allows a low privileged local attacker to view NETCONF traceoptions files, representing an exposure of sensitive information.



On all Junos OS Evolved platforms, when NETCONF traceoptions are configured, NETCONF traceoptions files get created with an incorrect group permission, which allows 

a low-privileged user can access sensitive information compromising the confidentiality of the system.



Junos OS Evolved: 




  *  All versions before 20.4R3-S9-EVO, 
  *  21.2-EVO before 21.2R3-S7-EVO, 
  *  21.4-EVO before 21.4R3-S5-EVO, 
  *  22.1-EVO before 22.1R3-S5-EVO, 
  *  22.2-EVO before 22.2R3-S3-EVO, 
  *  22.3-EVO before 22.3R3-EVO, 22.3R3-S2-EVO, 
  *  22.4-EVO before 22.4R3-EVO, 
  *  23.2-EVO before 23.2R1-S2-EVO, 23.2R2-EVO.

assistant: CWE-276
user: An Improper Check for Unusual or Exceptional Conditions vulnerability in the the IKE daemon (iked) of Juniper Networks Junos OS on SRX Series, MX Series with SPC3 and NFX350 allows allows an unauthenticated, network-based attacker sending specific mismatching parameters as part of the IPsec negotiation to trigger an iked crash leading to Denial of Service (DoS).

This issue is applicable to all platforms that run iked. This issue affects Junos OS on SRX Series, MX Series with SPC3 and NFX350: 



  *  All versions before 21.2R3-S8, 
  *  from 21.4 before 21.4R3-S7, 
  *  from 22.1 before 22.1R3-S2, 
  *  from 22.2 before 22.2R3-S1, 
  *  from 22.3 before 22.3R2-S1, 22.3R3, 
  *  from 22.4 before 22.4R1-S2, 22.4R2, 22.4R3.

assistant: CWE-754
user: A Missing Authorization vulnerability in the Socket Intercept (SI) command file interface of Juniper Networks Junos OS Evolved allows an authenticated, low-privilege local attacker to modify certain files, allowing the attacker to cause any command to execute with root privileges leading to privilege escalation ultimately compromising the system. 

This issue affects Junos OS Evolved: 



  *  All versions prior to 21.2R3-S8-EVO, 
  *  21.4 versions prior to  21.4R3-S6-EVO, 
  *  22.1 versions prior to 22.1R3-S5-EVO, 
  *  22.2 versions prior to 22.2R3-S3-EVO, 
  *  22.3 versions prior to 22.3R3-S3-EVO, 
  *  22.4 versions prior to 22.4R3-EVO, 
  *  23.2 versions prior to 23.2R2-EVO.

assistant: CWE-862
user: An Improper Handling of Exceptional Conditions vulnerability in the rpd-server of Juniper Networks Junos OS and Junos OS Evolved within cRPD allows an unauthenticated network-based attacker sending crafted TCP traffic to the routing engine (RE) to cause a CPU-based Denial of Service (DoS).

If specially crafted TCP traffic is received by the control plane, or a TCP session terminates unexpectedly, it will cause increased control plane CPU utilization by the rpd-server process.

While not explicitly required, the impact is more severe when RIB sharding is enabled.

Task accounting shows unexpected reads by the RPD Server jobs for shards:

user@junos> show task accounting detail
...
read:RPD Server.0.0.0.0+780.192.168.0.78+48886 TOT:00000003.00379787 MAX:00000000.00080516 RUNS: 233888\
read:RPD Server.0.0.0.0+780.192.168.0.78+49144 TOT:00000004.00007565 MAX:00000000.00080360 RUNS: 233888\
read:RPD Server.0.0.0.0+780.192.168.0.78+49694 TOT:00000003.00600584 MAX:00000000.00080463 RUNS: 233888\
read:RPD Server.0.0.0.0+780.192.168.0.78+50246 TOT:00000004.00346998 MAX:00000000.00080338 RUNS: 233888\



This issue affects:

Junos OS with cRPD: 

  *  All versions before 21.2R3-S8, 
  *  21.4 before 21.4R3-S7, 
  *  22.1 before 22.1R3-S6, 
  *  22.2 before 22.2R3-S4, 
  *  22.3 before 22.3R3-S3, 
  *  22.4 before 22.4R3-S2, 
  *  23.2 before 23.2R2-S2, 
  *  24.2 before 24.2R2; 


Junos OS Evolved with cRPD: 

  *  All versions before 21.4R3-S7-EVO, 
  *  22.2 before 22.2R3-S4-EVO, 
  *  22.3 before 22.3R3-S3-EVO, 
  *  22.4 before 22.4R3-S2-EVO, 
  *  23.2 before 23.2R2-EVO.

assistant: CWE-755
user: An Uncontrolled Resource Consumption vulnerability in the aftmand process of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to consume memory resources, resulting in a Denial of Service (DoS) condition. The processes do not recover on their own and must be manually restarted.

This issue affects both IPv4 and IPv6. 

Changes in memory usage can be monitored using the following CLI command:
user@device> show system memory node <fpc slot> | grep evo-aftmann
This issue affects Junos OS Evolved: 



  *  All versions before 21.2R3-S8-EVO, 
  *  21.3 versions before 21.3R3-S5-EVO, 
  *  21.4 versions before 21.4R3-S5-EVO, 
  *  22.1 versions before 22.1R3-S4-EVO, 
  *  22.2 versions before 22.2R3-S4-EVO,
  *  22.3 versions before 22.3R3-S3-EVO,
  *  22.4 versions before 22.4R2-S2-EVO, 22.4R3-EVO, 
  *  23.2 versions before 23.2R1-S1-EVO, 23.2R2-EVO.

assistant: CWE-400
user: A Missing Release of Memory after Effective Lifetime vulnerability in the routing process daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to send a malformed BGP Path attribute update which allocates memory used to log the bad path attribute. This memory is not properly freed in all circumstances, leading to a Denial of Service (DoS).

Consumed memory can be freed by manually restarting Routing Protocol Daemon (rpd).

Memory utilization could be monitored by: 
user@host> show system memory or show system monitor memory status

This issue affects:

Junos OS:   *  All versions before 21.2R3-S8, 
  *  from 21.4 before 21.4R3-S8,

  *  from 22.2 before 22.2R3-S4, 
  *  from 22.3 before 22.3R3-S3, 
  *  from 22.4 before 22.4R3-S3,
  *  from 23.2 before 23.2R2-S1, 
  *  from 23.4 before 23.4R1-S2, 23.4R2.


Junos OS Evolved:
  *  All versions before 21.2R3-S8-EVO, 
  *  from 21.4 before 21.4R3-S8-EVO,
  *  from 22.2 before 22.2R3-S4-EVO, 
  *  from 22.3 before 22.3R3-S3-EVO, 
  *  from 22.4 before 22.4R3-S3-EVO,

  *  from 23.2 before 23.2R2-S1-EVO, 
  *  from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO.

assistant: CWE-401
user: A Missing Release of Memory after Effective Lifetime vulnerability in the rtlogd process of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, adjacent attacker to trigger internal events cause ( which can be done by repeated port flaps) to cause a slow memory leak, ultimately leading to a Denial of Service (DoS). 

Memory can only be recovered by manually restarting rtlogd process. 
The memory usage can be monitored using the below command.

    user@host> show system processes extensive | match rtlog 



This issue affects Junos OS on MX Series with SPC3 line card: 



  *  from 21.2R3 before 21.2R3-S8, 
  *  from 21.4R2 before 21.4R3-S6, 
  *  from 22.1 before 22.1R3-S5, 
  *  from 22.2 before 22.2R3-S3, 
  *  from 22.3 before 22.3R3-S2, 
  *  from 22.4 before 22.4R3-S1, 
  *  from 23.2 before 23.2R2, 
  *  from 23.4 before 23.4R2.

assistant: CWE-401
user: An Uncontrolled Resource Consumption vulnerability in the H.323 ALG (Application Layer Gateway) of  Juniper Networks Junos OS on SRX Series and MX Series with SPC3 and MS-MPC/MIC, allows an unauthenticated network-based attacker to send specific packets causing traffic loss leading to Denial of Service (DoS). 

Continued receipt and processing of these specific packets will sustain the Denial of Service condition.

The memory usage can be monitored using the below command.

  user@host> show usp memory segment sha data objcache jsf 
This issue affects SRX Series and MX Series with SPC3 and MS-MPC/MIC: 

  *   20.4 before 20.4R3-S10, 
  *   21.2 before 21.2R3-S6, 
  *   21.3 before 21.3R3-S5, 
  *   21.4 before 21.4R3-S6, 
  *   22.1 before 22.1R3-S4, 
  *   22.2 before 22.2R3-S2, 
  *   22.3 before 22.3R3-S1, 
  *   22.4 before 22.4R3, 
  *   23.2 before 23.2R2.

assistant: CWE-400
user: An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to send arbitrary data to the device, which leads msvcsd process to crash with limited availability impacting Denial of Service (DoS) and allows unauthorized network access to the device, potentially impacting system integrity.

This issue only happens when inline jflow is configured.

This does not impact any forwarding traffic. The impacted services MSVCS-DB app crashes momentarily and recovers by itself. 

This issue affects Juniper Networks Junos OS Evolved: 
  *  21.4 versions earlier than 21.4R3-S7-EVO; 
  *  22.2 versions earlier than 22.2R3-S3-EVO;
  *  22.3 versions earlier than 22.3R3-S2-EVO;
  *  22.4 versions earlier than 22.4R3-EVO;
  *  23.2 versions earlier than 23.2R1-S2-EVO, 23.2R2-EVO.

assistant: CWE-668
user: A Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability the 

Routing Protocol Daemon (rpd)

 of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to inject incremental routing updates when BGP multipath is enabled, causing rpd to crash and restart, resulting in a Denial of Service (DoS). Since this is a timing issue (race condition), the successful exploitation of this vulnerability is outside the attacker's control.  However, continued receipt and processing of this packet may create a sustained Denial of Service (DoS) condition.

On all Junos OS and Junos OS Evolved platforms with BGP multipath enabled, a specific multipath calculation removes the original next hop from the multipath lead routes nexthop-set. When this change happens, multipath relies on certain internal timing to record the update.  Under certain circumstance and with specific timing, this could result in an rpd crash.

This issue only affects systems with BGP multipath enabled.


This issue affects:

Junos OS: 


  *  All versions of 21.1
  *  from 21.2 before 21.2R3-S7, 
  *  from 21.4 before 21.4R3-S6, 
  *  from 22.1 before 22.1R3-S5, 
  *  from 22.2 before 22.2R3-S3, 
  *  from 22.3 before 22.3R3-S2, 
  *  from 22.4 before 22.4R3, 
  *  from 23.2 before 23.2R2.




Junos OS Evolved: 


  *  All versions of 21.1-EVO,
  *  All versions of 21.2-EVO,
  *  from 21.4-EVO before 21.4R3-S6-EVO, 
  *  from 22.1-EVO before 22.1R3-S5-EVO, 
  *  from 22.2-EVO before 22.2R3-S3-EVO, 
  *  from 22.3-EVO before 22.3R3-S2-EVO, 
  *  from 22.4-EVO before 22.4R3-EVO, 
  *  from 23.2-EVO before 23.2R2-EVO.



Versions of Junos OS before 21.1R1 are unaffected by this vulnerability.
Versions of Junos OS Evolved before 21.1R1-EVO are unaffected by this vulnerability.

assistant: CWE-362
user: An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specific malformed BGP update message to cause the session to reset, resulting in a Denial of Service (DoS).  Continued receipt and processing of these malformed BGP update messages will create a sustained Denial of Service (DoS) condition.

Upon receipt of a BGP update message over an established BGP session containing a specifically malformed tunnel encapsulation attribute, when segment routing is enabled, internal processing of the malformed attributes within the update results in improper parsing of remaining attributes, leading to session reset:

BGP SEND Notification code 3 (Update Message Error) subcode 1 (invalid attribute list)

Only systems with segment routing enabled are vulnerable to this issue.

This issue affects eBGP and iBGP, in both IPv4 and IPv6 implementations, and requires a remote attacker to have at least one established BGP session.

This issue affects:

Junos OS: 


  *  All versions before 21.4R3-S8, 
  *  from 22.2 before 22.2R3-S4, 
  *  from 22.3 before 22.3R3-S3, 
  *  from 22.4 before 22.4R3-S3, 
  *  from 23.2 before 23.2R2-S1, 
  *  from 23.4 before 23.4R1-S2, 23.4R2.


Junos OS Evolved: 

  *  All versions before 21.4R3-S8-EVO, 
  *  from 22.2-EVO before 22.2R3-S4-EVO, 
  *  from 22.3-EVO before 22.3R3-S3-EVO, 
  *  from 22.4-EVO before 22.4R3-S3-EVO, 
  *  from 23.2-EVO before 23.2R2-S1-EVO, 
  *  from 23.4-EVO before 23.4R1-S2-EVO, 23.4R2-EVO.

assistant: CWE-755
user: An Uncontrolled Resource Consumption vulnerability in the 

Layer 2 Address Learning Daemon (l2ald)

 of Juniper Networks Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a memory leak, eventually exhausting all system memory, leading to a system crash and Denial of Service (DoS).

Certain MAC table updates cause a small amount of memory to leak.  Once memory utilization reaches its limit, the issue will result in a system crash and restart.

To identify the issue, execute the CLI command:
 
user@device> show platform application-info allocations app l2ald-agent
EVL Object Allocation Statistics:
 
 Node    Application       Context   Name                                 Live     Allocs     Fails       Guids
 re0     l2ald-agent                 net::juniper::rtnh::L2Rtinfo         1069096  1069302    0           1069302
 re0     l2ald-agent                 net::juniper::rtnh::NHOpaqueTlv       114      195        0           195



This issue affects Junos OS Evolved: 


  *  All versions before 21.4R3-S8-EVO,

  *  from 22.2-EVO before 22.2R3-S4-EVO, 
  *  from 22.3-EVO before 22.3R3-S3-EVO, 
  *  from 22.4-EVO before 22.4R3-EVO, 
  *  from 23.2-EVO before 23.2R2-EVO.

assistant: CWE-400
user: An Unchecked Return Value vulnerability in the Routing Protocol Daemon (rpd) on Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows a logically adjacent, unauthenticated attacker sending a specific PIM packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS), when PIM is configured with Multicast-only Fast Reroute (MoFRR). Continued receipt and processing of this packet may create a sustained Denial of Service (DoS) condition.

This issue is observed on Junos and Junos Evolved platforms where PIM is configured along with MoFRR. MoFRR tries to select the active path, but due to an internal timing issue, rpd is unable to select the forwarding next-hop towards the source, resulting in an rpd crash.

This issue affects:

Junos OS: 


  *  All versions before 20.4R3-S10, 
  *  from 21.2 before 21.2R3-S7, 
  *  from 21.4 before 21.4R3-S6, 
  *  from 22.1 before 22.1R3-S5, 
  *  from 22.2 before 22.2R3-S3, 
  *  from 22.3 before 22.3R3, 
  *  from 22.4 before 22.4R2; 




Junos OS Evolved: 


  *  All versions before 20.4R3-S10 -EVO,
  *  All versions of 21.2-EVO,
  *  from 21.4-EVO before 21.4R3-S9-EVO,
  *  from 22.1-EVO before 22.1R3-S5-EVO,
  *  from 22.2-EVO before 22.2R3-S3-EVO,
  *  from 22.3-EVO before 22.3R3-EVO,
  *  from 22.4-EVO before 22.4R2-EVO.

assistant: CWE-252