CVE-2024-47491

Oct. 17, 2024, 6:15 p.m.

5.9
Medium

Description

An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based, unauthenticated attacker to cause Denial of Service (DoS). When a BGP UPDATE with malformed path attribute is received over an established BGP session, rpd crashes and restarts. Continuous receipt of a BGP UPDATE with a specifically malformed path attribute will create a sustained Denial of Service (DoS) condition for impacted devices. While this issue affects systems running 32-bit and 64-bit systems, the probability of impact on 64-bit system is extremely low.  According to KB25803 https://supportportal.juniper.net/s/article/Junos-How-to-check-if-Junos-OS-is-64-or-32-bit-on-a-router , customers can confirm 32-bit or 64-bit system via the ' show version detail ' command:      lab@router> show version detail| match 32      JUNOS 32-bit kernel Software Suite       lab@router> show version detail| match 64      JUNOS 64-bit kernel Software Suite  This issue affects:  Juniper Networks Junos OS:  * All versions before 21.4R3-S8,  * from 22.2 before 22.2R3-S4,  * from 22.4 before 22.4R3-S3,  * from 23.2 before 23.2R2-S1,  * from 23.4 before 23.4R1-S2, 23.4R2.  Juniper Networks Junos OS Evolved:  * All versions before 21.4R3-S8-EVO, * from 22.2 before 22.2R3-S4-EVO, * from 22.4 before 22.4R3-S3-EVO, * from 23.2 before 23.2R2-S1-EVO, * from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO.

Product(s) Impacted

Product Versions
Juniper Networks Junos OS
  • All versions before 21.4R3-S8
  • from 22.2 before 22.2R3-S4
  • from 22.4 before 22.4R3-S3
  • from 23.2 before 23.2R2-S1
  • from 23.4 before 23.4R1-S2
  • 23.4R2
Juniper Networks Junos OS Evolved
  • All versions before 21.4R3-S8-EVO
  • from 22.2 before 22.2R3-S4-EVO
  • from 22.4 before 22.4R3-S3-EVO
  • from 23.2 before 23.2R2-S1-EVO
  • from 23.4 before 23.4R1-S2-EVO
  • 23.4R2-EVO

Weaknesses

CWE-755
Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.

CVSS Score

5.9 / 10

CVSS Data

  • Attack Vector: NETWORK
  • Attack Complexity: HIGH
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: HIGH
  • View Vector String

    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Date

  • Published: Oct. 11, 2024, 4:15 p.m.
  • Last Modified: Oct. 17, 2024, 6:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

sirt@juniper.net

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.