CVE-2024-21596

Junos OS and Junos OS Evolved: A specific BGP UPDATE message will cause a crash in the backup Routing Engine in NSR-enabled devices

State: Published
Severity: 5.3 Medium
Published: Jan 12, 2024
Updated: Sep 25, 2024
Reserved: Dec 27, 2023

Read the record on cve.org

Description

A Heap-based Buffer Overflow vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS).

If an attacker sends a specific BGP UPDATE message to the device, this will cause a memory overwrite and therefore an RPD crash and restart in the backup Routing Engine (RE). Continued receipt of these packets will cause a sustained Denial of Service (DoS) condition in the backup RE.

The primary RE is not impacted by this issue and there is no impact on traffic.

This issue only affects devices with NSR enabled.

Note: NSR is not supported on the SRX Series and is therefore not affected by this vulnerability. This issue requires an attacker to have an established BGP session to a system affected by the issue. This issue affects both eBGP and iBGP implementations.

This issue affects:

Juniper Networks Junos OS

* All versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S4; * 22.2 versions earlier than 22.2R3-S2; * 22.3 versions earlier than 22.3R3-S1; * 22.4 versions earlier than 22.4R2-S2, 22.4R3; * 23.1 versions earlier than 23.1R2; * 23.2 versions earlier than 23.2R1-S2, 23.2R2.

Juniper Networks Junos OS Evolved

* All versions earlier than 21.3R3-S5-EVO; * 21.4-EVO versions earlier than 21.4R3-S5-EVO; * 22.1-EVO versions earlier than 22.1R3-S4-EVO; * 22.2-EVO versions earlier than 22.2R3-S2-EVO; * 22.3-EVO versions later than 22.3R1-EVO; * 22.4-EVO versions earlier than 22.4R2-S2-EVO, 22.4R3-EVO; * 23.1-EVO versions earlier than 23.1R2-EVO; * 23.2-EVO versions earlier than 23.2R1-S2-EVO, 23.2R2-EVO.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	juniper

Weaknesses

CWE-122 Heap-based Buffer Overflow

Affected Products

Product	Versions
Junos OSJuniper Networks	before 20.4R3-S9Affected 21.2 to before 21.2R3-S7Affected 21.3 to before 21.3R3-S5Affected 21.4 to before 21.4R3-S5Affected 22.1 to before 22.1R3-S4Affected 22.2 to before 22.2R3-S2Affected 22.3 to before 22.3R3-S1Affected 22.4 to before 22.4R2-S2, 22.4R3Affected 23.1 to before 23.1R2Affected 23.2 to before 23.2R1-S2, 23.2R2Affected
Junos OS EvolvedJuniper Networks	before 21.3R3-S5-EVOAffected 21.4-EVO to before 21.4R3-S5-EVOAffected 22.1-EVO to before 22.1R3-S4-EVOAffected 22.2-EVO to before 22.2R3-S2-EVOAffected 22.4-EVO to before 22.4R2-S2-EVO, 22.4R3-EVOAffected 23.1-EVO to before 23.1R2-EVOAffected 23.2-EVO to before 23.2R1-S2-EVO, 23.2R2-EVOAffected

References

https://supportportal.juniper.net/JSA75735vendor-advisory
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:Ntechnical-description

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.