Product Affected

JUNOS Internet software releases 5.2R1.4, 5.2R2.3, 5.2R3.4, 5.2R4.4, 5.3R1.2, 5.3R2.4, 5.3R3.3, and 5.4R1.4
High

Problem

In the releases affected, JUNOS IPSec implementation does not ensure that an IPSec packet is long enough to contain the required authentication data. As a result, spoofing very short ESP or AH packets with known source, destination, Security Payload Identifier, and a high sequence number can cause a kernel panic. This problem is documented as PR/27664.

Solution

The IPSec code was modified to correctly verify that IPSec packets are of sufficient length to include the required authentication data.

Customers should install an updated release of JUNOS software. All releases of JUNOS software built on or after August 23rd, 2002, contain the fix. As a work-around, customers can implement a firewall filter and apply it to the lo0 interface to prevent delivery of IPSec ESP and AH packets. Alternatively, customers can remove all IPSec configuration from the router to avoid the vulnerability.

Severity Assessment

A remote attacker can cause a kernel panic and deny router service to legitimate users. No direct access to or privileges on the router are required to launch this denial-of-service (DoS) attack.