certfr_avis - certfr-2023-avi-0481

CERTFR-2023-AVI-0481

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans Juniper Junos OS et Junos OS Evolved. Elle permet à un attaquant de provoquer un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Juniper Networks	Junos OS Evolved	Les versions Junos OS Evolved suivantes sont en attente de correctif : 20.4R3-S8-EVO, 21.2R3-S6-EVO, 21.3R3-S5-EVO, 22.1R3-S4-EVO, 22.2R3-S2-EVO, 22.3R2-S2-EVO, 22.3R3-S1-EVO, 22.4R2-S1-EVO, 22.4R3-EVO, 23.1R1-S1-EVO, 23.1R2-EVO* et 23.2R1-EVO*
Juniper Networks	Junos OS Evolved	Junos OS versions antérieures à 21.4R3-S4
Juniper Networks	Junos OS Evolved	Les versions Junos OS suivantes sont en attente de correctif : 20.4R3-S8, 21.2R3-S6, 21.3R3-S5, 22.1R3-S4, 22.2R3-S2, 22.3R2-S2, 22.3R3-S1, 22.4R2-S1, 22.4R3, 23.1R1-S1, 23.1R2* et 23.2R1*
Juniper Networks	Junos OS Evolved	Junos OS Evolved versions antérieures à 21.4R3-S4-EVO

References

Title

Publication Time

CVE-2023-0026 (GCVE-0-2023-0026)

Vulnerability from cvelistv5

Published

2023-06-21 00:00

Modified

2024-12-06 19:18

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-20 - Improper Input Validation
Denial of Service (DoS)

Summary

An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When a BGP update message is received over an established BGP session, and that message contains a specific, optional transitive attribute, this session will be torn down with an update message error. This issue cannot propagate beyond an affected system as the processing error occurs as soon as the update is received. This issue is exploitable remotely as the respective attribute can propagate through unaffected systems and intermediate AS (if any). Continuous receipt of a BGP update containing this attribute will create a sustained Denial of Service (DoS) condition. Some customers have experienced these BGP session flaps which prompted Juniper SIRT to release this advisory out of cycle before fixed releases are widely available as there is an effective workaround. This issue affects: Juniper Networks Junos OS 15.1R1 and later versions prior to 20.4R3-S8; 21.1 version 21.1R1 and later versions prior to 21.2R3-S6; 21.3 versions prior to 21.3R3-S5; 21.4 versions prior to 21.4R3-S4; 22.1 versions prior to 22.1R3-S4; 22.2 versions prior to 22.2R3-S2; 22.3 versions prior to 22.3R2-S2, 22.3R3-S1; 22.4 versions prior to 22.4R2-S1, 22.4R3; 23.1 versions prior to 23.1R1-S1, 23.1R2. Juniper Networks Junos OS Evolved All versions prior to 20.4R3-S8-EVO; 21.1 version 21.1R1-EVO and later versions prior to 21.2R3-S6-EVO; 21.3 versions prior to 21.3R3-S5-EVO; 21.4 versions prior to 21.4R3-S4-EVO; 22.1 versions prior to 22.1R3-S4-EVO; 22.2 versions prior to 22.2R3-S2-EVO; 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO; 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO; 23.1 versions prior to 23.1R1-S1-EVO, 23.1R2-EVO.

References

URL

Tags

	https://supportportal.juniper.net/JSA71542	vendor-advisory
	https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/topic-map/bgp-error-messages.html	product

Impacted products

Vendor

Product

Version

Juniper Networks

Junos OS

Patch: unspecified   < 15.1R1
Version: unspecified   < 20.4R3-S8
Version: 21.1   < 21.1*
Version: 21.2   < 21.2R3-S6
Version: 21.3   < 21.3R3-S5
Version: 21.4   < 21.4R3-S4
Version: 22.1   < 22.1R3-S4
Version: 22.2   < 22.3R2-S2, 22.3R3-S1
Version: 22.3   < 22.2R3-S2
Version: 22.4   < 22.4R2-S1, 22.4R3
Version: 23.1   < 23.1R1-S1, 23.1R2

Juniper Networks

Junos OS Evolved

Version: unspecified   < 20.4R3-S8-EVO
Version: 21.1R1-EVO   < 21.1*
Version: 21.2   < 21.2R3-S6-EVO
Version: 21.3   < 21.3R3-S5-EVO
Version: 21.4   < 21.4R3-S4-EVO
Version: 22.1   < 22.1R3-S4-EVO
Version: 22.2   < 22.2R3-S2-EVO
Version: 22.3   < 22.3R2-S2-EVO, 22.3R3-S1-EVO
Version: 22.4   < 22.4R2-S1-EVO, 22.4R3-EVO
Version: 23.1   < 23.1R1-S1-EVO, 23.1R2-EVO

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:54:32.573Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://supportportal.juniper.net/JSA71542"
          },
          {
            "tags": [
              "product",
              "x_transferred"
            ],
            "url": "https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/topic-map/bgp-error-messages.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-0026",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-06T19:16:05.401961Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-06T19:18:31.348Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "15.1R1",
              "status": "unaffected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "20.4R3-S8",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "21.1*",
              "status": "affected",
              "version": "21.1",
              "versionType": "custom"
            },
            {
              "lessThan": "21.2R3-S6",
              "status": "affected",
              "version": "21.2",
              "versionType": "custom"
            },
            {
              "lessThan": "21.3R3-S5",
              "status": "affected",
              "version": "21.3",
              "versionType": "custom"
            },
            {
              "lessThan": "21.4R3-S4",
              "status": "affected",
              "version": "21.4",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1R3-S4",
              "status": "affected",
              "version": "22.1",
              "versionType": "custom"
            },
            {
              "lessThan": "22.3R2-S2, 22.3R3-S1",
              "status": "affected",
              "version": "22.2",
              "versionType": "custom"
            },
            {
              "lessThan": "22.2R3-S2",
              "status": "affected",
              "version": "22.3",
              "versionType": "custom"
            },
            {
              "lessThan": "22.4R2-S1, 22.4R3",
              "status": "affected",
              "version": "22.4",
              "versionType": "custom"
            },
            {
              "lessThan": "23.1R1-S1, 23.1R2",
              "status": "affected",
              "version": "23.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Junos OS Evolved",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "20.4R3-S8-EVO",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "21.1*",
              "status": "affected",
              "version": "21.1R1-EVO",
              "versionType": "custom"
            },
            {
              "lessThan": "21.2R3-S6-EVO",
              "status": "affected",
              "version": "21.2",
              "versionType": "custom"
            },
            {
              "lessThan": "21.3R3-S5-EVO",
              "status": "affected",
              "version": "21.3",
              "versionType": "custom"
            },
            {
              "lessThan": "21.4R3-S4-EVO",
              "status": "affected",
              "version": "21.4",
              "versionType": "custom"
            },
            {
              "lessThan": "22.1R3-S4-EVO",
              "status": "affected",
              "version": "22.1",
              "versionType": "custom"
            },
            {
              "lessThan": "22.2R3-S2-EVO",
              "status": "affected",
              "version": "22.2",
              "versionType": "custom"
            },
            {
              "lessThan": "22.3R2-S2-EVO, 22.3R3-S1-EVO",
              "status": "affected",
              "version": "22.3",
              "versionType": "custom"
            },
            {
              "lessThan": "22.4R2-S1-EVO, 22.4R3-EVO",
              "status": "affected",
              "version": "22.4",
              "versionType": "custom"
            },
            {
              "lessThan": "23.1R1-S1-EVO, 23.1R2-EVO",
              "status": "affected",
              "version": "23.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-06-21T04:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When a BGP update message is received over an established BGP session, and that message contains a specific, optional transitive attribute, this session will be torn down with an update message error. This issue cannot propagate beyond an affected system as the processing error occurs as soon as the update is received. This issue is exploitable remotely as the respective attribute can propagate through unaffected systems and intermediate AS (if any). Continuous receipt of a BGP update containing this attribute will create a sustained Denial of Service (DoS) condition. Some customers have experienced these BGP session flaps which prompted Juniper SIRT to release this advisory out of cycle before fixed releases are widely available as there is an effective workaround.\u003c/p\u003eThis issue affects:\u003cbr\u003eJuniper Networks Junos OS\u003cbr\u003e15.1R1 and later versions prior to 20.4R3-S8;\u003cbr\u003e21.1 version 21.1R1 and later versions prior to 21.2R3-S6;\u003cbr\u003e21.3 versions prior to 21.3R3-S5;\u003cbr\u003e21.4 versions prior to 21.4R3-S4;\u003cbr\u003e22.1 versions prior to 22.1R3-S4;\u003cbr\u003e22.2 versions prior to 22.2R3-S2;\u003cbr\u003e22.3 versions prior to 22.3R2-S2, 22.3R3-S1;\u003cbr\u003e22.4 versions prior to 22.4R2-S1, 22.4R3;\u003cbr\u003e23.1 versions prior to 23.1R1-S1, 23.1R2.\u003cbr\u003e\u003cbr\u003eJuniper Networks Junos OS Evolved\u003cbr\u003eAll versions prior to 20.4R3-S8-EVO;\u003cbr\u003e21.1 version 21.1R1-EVO and later versions prior to 21.2R3-S6-EVO;\u003cbr\u003e21.3 versions prior to 21.3R3-S5-EVO;\u003cbr\u003e21.4 versions prior to 21.4R3-S4-EVO;\u003cbr\u003e22.1 versions prior to 22.1R3-S4-EVO;\u003cbr\u003e22.2 versions prior to 22.2R3-S2-EVO;\u003cbr\u003e22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;\u003cbr\u003e22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO;\u003cbr\u003e23.1 versions prior to 23.1R1-S1-EVO, 23.1R2-EVO.\u003cbr\u003e"
            }
          ],
          "value": "An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When a BGP update message is received over an established BGP session, and that message contains a specific, optional transitive attribute, this session will be torn down with an update message error. This issue cannot propagate beyond an affected system as the processing error occurs as soon as the update is received. This issue is exploitable remotely as the respective attribute can propagate through unaffected systems and intermediate AS (if any). Continuous receipt of a BGP update containing this attribute will create a sustained Denial of Service (DoS) condition. Some customers have experienced these BGP session flaps which prompted Juniper SIRT to release this advisory out of cycle before fixed releases are widely available as there is an effective workaround.\n\nThis issue affects:\nJuniper Networks Junos OS\n15.1R1 and later versions prior to 20.4R3-S8;\n21.1 version 21.1R1 and later versions prior to 21.2R3-S6;\n21.3 versions prior to 21.3R3-S5;\n21.4 versions prior to 21.4R3-S4;\n22.1 versions prior to 22.1R3-S4;\n22.2 versions prior to 22.2R3-S2;\n22.3 versions prior to 22.3R2-S2, 22.3R3-S1;\n22.4 versions prior to 22.4R2-S1, 22.4R3;\n23.1 versions prior to 23.1R1-S1, 23.1R2.\n\nJuniper Networks Junos OS Evolved\nAll versions prior to 20.4R3-S8-EVO;\n21.1 version 21.1R1-EVO and later versions prior to 21.2R3-S6-EVO;\n21.3 versions prior to 21.3R3-S5-EVO;\n21.4 versions prior to 21.4R3-S4-EVO;\n22.1 versions prior to 22.1R3-S4-EVO;\n22.2 versions prior to 22.2R3-S2-EVO;\n22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;\n22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO;\n23.1 versions prior to 23.1R1-S1-EVO, 23.1R2-EVO.\n"
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eJuniper SIRT is not aware of any malicious exploitation of this vulnerability.\u003c/p\u003e"
            }
          ],
          "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "Denial of Service (DoS)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-17T15:59:01.049Z",
        "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "shortName": "juniper"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://supportportal.juniper.net/JSA71542"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/topic-map/bgp-error-messages.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe following software releases have been updated to resolve this specific issue:\u003c/p\u003e\u003cp\u003eJunos OS: 20.4R3-S8*, 21.2R3-S6*, 21.3R3-S5*, 21.4R3-S4, 22.1R3-S4*, 22.2R3-S2*, 22.3R2-S2*, 22.3R3-S1*, 22.4R2-S1*, 22.4R3*, 23.1R1-S1*, 23.1R2*, 23.2R1*, and all subsequent releases;\u003c/p\u003e\u003cp\u003eJunos OS Evolved: 20.4R3-S8-EVO*, 21.2R3-S6-EVO*, 21.3R3-S5-EVO*, 21.4R3-S4-EVO, 22.1R3-S4-EVO*, 22.2R3-S2-EVO*, 22.3R2-S2-EVO*, 22.3R3-S1-EVO*, 22.4R2-S1-EVO*, 22.4R3-EVO*, 23.1R1-S1-EVO*, 23.1R2-EVO*, 23.2R1-EVO*, and all subsequent releases.\u003c/p\u003e\u003cp\u003e*Pending Publication\u003c/p\u003e"
            }
          ],
          "value": "The following software releases have been updated to resolve this specific issue:\n\nJunos OS: 20.4R3-S8*, 21.2R3-S6*, 21.3R3-S5*, 21.4R3-S4, 22.1R3-S4*, 22.2R3-S2*, 22.3R2-S2*, 22.3R3-S1*, 22.4R2-S1*, 22.4R3*, 23.1R1-S1*, 23.1R2*, 23.2R1*, and all subsequent releases;\n\nJunos OS Evolved: 20.4R3-S8-EVO*, 21.2R3-S6-EVO*, 21.3R3-S5-EVO*, 21.4R3-S4-EVO, 22.1R3-S4-EVO*, 22.2R3-S2-EVO*, 22.3R2-S2-EVO*, 22.3R3-S1-EVO*, 22.4R2-S1-EVO*, 22.4R3-EVO*, 23.1R1-S1-EVO*, 23.1R2-EVO*, 23.2R1-EVO*, and all subsequent releases.\n\n*Pending Publication\n\n"
        }
      ],
      "source": {
        "advisory": "JSA71542",
        "defect": [
          "1739919"
        ],
        "discovery": "USER"
      },
      "title": "2023-06: Out-of-Cycle Security Bulletin: Junos OS and Junos OS Evolved: A BGP session will flap upon receipt of a specific, optional transitive attribute",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe workaround is to configure BGP error tolerance by way of:\u003c/p\u003e\u003ccode\u003e  [ protocols bgp bgp-error-tolerance ... ]\u003c/code\u003e\u003cbr/\u003e\u003cp\u003ewhich causes malformed BGP routes to be \u0027treated as withdrawal\u0027 instead of bringing down the BGP session. Additional details can be found at https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/topic-map/bgp-error-messages.html\u003c/p\u003e\u003cp\u003eJuniper considers configuring this option to be a Best Common Practice (BCP) as it not only prevents this issue from happening, but protects against similar issues as well.\u003c/p\u003e"
            }
          ],
          "value": "The workaround is to configure BGP error tolerance by way of:\n\n  [ protocols bgp bgp-error-tolerance ... ]\nwhich causes malformed BGP routes to be \u0027treated as withdrawal\u0027 instead of bringing down the BGP session. Additional details can be found at https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/topic-map/bgp-error-messages.html\n\nJuniper considers configuring this option to be a Best Common Practice (BCP) as it not only prevents this issue from happening, but protects against similar issues as well.\n\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
    "assignerShortName": "juniper",
    "cveId": "CVE-2023-0026",
    "datePublished": "2023-06-21T00:00:00",
    "dateReserved": "2022-12-27T00:00:00",
    "dateUpdated": "2024-12-06T19:18:31.348Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted