CVE-2024-39525
Oct. 10, 2024, 12:51 p.m.
Tags
CVSS Score
Product(s) Impacted
Juniper Networks Junos OS
- All versions before 21.2R3-S8
- from 21.4 before 21.4R3-S8
- from 22.2 before 22.2R3-S4
- from 22.3 before 22.3R3-S4
- from 22.4 before 22.4R3-S3
- from 23.2 before 23.2R2-S1
- from 23.4 before 23.4R2
Juniper Networks Junos OS Evolved
- All versions before 21.2R3-S8-EVO
- from 21.4-EVO before 21.4R3-S8-EVO
- from 22.2-EVO before 22.2R3-S4-EVO
- from 22.3-EVO before 22.3R3-S4-EVO
- from 22.4-EVO before 22.4R3-S3-EVO
- from 23.2-EVO before 23.2R2-S1-EVO
- from 23.4-EVO before 23.4R2-EVO
Description
An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specific BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. This issue only affects systems with BGP traceoptions enabled and requires a BGP session to be already established. Systems without BGP traceoptions enabled are not affected by this issue. This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability. This issue affects: Junos OS: * All versions before 21.2R3-S8, * from 21.4 before 21.4R3-S8, * from 22.2 before 22.2R3-S4, * from 22.3 before 22.3R3-S4, * from 22.4 before 22.4R3-S3, * from 23.2 before 23.2R2-S1, * from 23.4 before 23.4R2; Junos OS Evolved: * All versions before 21.2R3-S8-EVO, * from 21.4-EVO before 21.4R3-S8-EVO, * from 22.2-EVO before 22.2R3-S4-EVO, * from 22.3-EVO before 22.3R3-S4-EVO, * from 22.4-EVO before 22.4R3-S3-EVO, * from 23.2-EVO before 23.2R2-S1-EVO, * from 23.4-EVO before 23.4R2-EVO.
Weaknesses
CWE-755
Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
CWE ID: 755Date
Published: Oct. 9, 2024, 8:15 p.m.
Last Modified: Oct. 10, 2024, 12:51 p.m.
Status : Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
sirt@juniper.net
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Base Score
Exploitability Score
Impact Score
Base Severity
HIGHCVSS Vector String
The CVSS vector string provides an in-depth view of the vulnerability metrics.
View Vector StringCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H