CVE-2021-0214
Assigner: juniper
Published: 2021-04-14T00:00:00
State: PUBLISHED
affected: product: Junos OS
vendor: Juniper Networks
versions: lessThan: 17.3R3-S11
status: affected
version: 17.3
versionType: custom
lessThan: 17.4R2-S12, 17.4R3-S4
status: affected
version: 17.4
versionType: custom
lessThan: 18.1R3-S12
status: affected
version: 18.1
versionType: custom
lessThan: 18.2R2-S8, 18.2R3-S7
status: affected
version: 18.2
versionType: custom
lessThan: 18.3R3-S4
status: affected
version: 18.3
versionType: custom
lessThan: 18.4R1-S8, 18.4R2-S7, 18.4R3-S6
status: affected
version: 18.4
versionType: custom
lessThan: 19.1R1-S6, 19.1R2-S2, 19.1R3-S4
status: affected
version: 19.1
versionType: custom
lessThan: 19.2R1-S5, 19.2R3-S1
status: affected
version: 19.2
versionType: custom
lessThan: 19.3R2-S5, 19.3R3-S1
status: affected
version: 19.3
versionType: custom
lessThan: 19.4R2-S2, 19.4R3
status: affected
version: 19.4
versionType: custom
lessThan: 20.1R2
status: affected
version: 20.1
versionType: custom
lessThan: 20.2R1-S2, 20.2R2
status: affected
version: 20.2
versionType: custom
datePublic: 2021-04-14T00:00:00
descriptions: value: A vulnerability in the distributed or centralized periodic packet management daemon (PPMD) of Juniper Networks Junos OS may cause receipt of a malformed packet to crash and restart the PPMD process, leading to network destabilization, service interruption, and a Denial of Service (DoS) condition. Continued receipt and processing of these malformed packets will repeatedly crash the PPMD process and sustain the Denial of Service (DoS) condition. Due to the nature of the specifically crafted packet, exploitation of this issue requires direct, adjacent connectivity to the vulnerable component. This issue affects Juniper Networks Junos OS: 17.3 versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R2-S12, 17.4R3-S4; 18.1 versions prior to 18.1R3-S12; 18.2 versions prior to 18.2R2-S8, 18.2R3-S7; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8, 18.4R2-S7, 18.4R3-S6; 19.1 versions prior to 19.1R1-S6, 19.1R2-S2, 19.1R3-S4; 19.2 versions prior to 19.2R1-S5, 19.2R3-S1; 19.3 versions prior to 19.3R2-S5, 19.3R3-S1; 19.4 versions prior to 19.4R2-S2, 19.4R3; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R1-S2, 20.2R2.
exploits: value: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-20
description: CWE-20 Improper Input Validation
type: CWE
descriptions: description: Denial of Service
type: text
solutions: value: The following software releases have been updated to resolve this specific issue: Junos OS 17.3R3-S11, 17.4R2-S12, 17.4R3-S4, 18.1R3-S12, 18.2R2-S8, 18.2R3-S7, 18.3R3-S4, 18.4R1-S8, 18.4R2-S7, 18.4R3-S6, 19.1R1-S6, 19.1R2-S2, 19.1R3-S4, 19.2R1-S5, 19.2R3-S1, 19.3R2-S5, 19.3R3-S1, 19.4R2-S2, 19.4R3, 20.1R2, 20.2R1-S2, 20.2R2, 20.3R1, and all subsequent releases.

source: advisory: JSA11117
defect: 1530219
discovery: USER
title: Junos OS: Denial of Service in ppmd upon receipt of malformed packet
workarounds: value: There are no viable workarounds for this issue.
x_generator: engine: Vulnogram 0.0.9