A firewall bypass vulnerability in the proxy ARP service of Juniper Networks Junos OS allows an attacker to cause a high CPU condition leading to a Denial of Service (DoS).
This issue affects only IPv4.
Affected releases are Juniper Networks Junos OS:
An example configuration snippet is below:
root@device# show security nat proxy-arp
interface ge-0/0/0.0 {
address {
2.2.2.5/32;
}
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
This issue was seen during production usage.
This issue has been assigned CVE-2019-0033.
The following software releases have been updated to resolve this specific issue: 12.1X46-D71, 12.1X46-D73, 12.3X48-D50, 15.1X49-D75, 17.3R1, and all subsequent releases. Please refer to KB21785 [juniper.net] for further information related to configuring Proxy ARP services. This issue is being tracked as PR 1208910 which is visible on the Customer Support website. Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).
Software Releases, patches and updates are available at https://www.juniper.net/support/downloads/ .
Discontinue use of proxy ARP.
deactivate security nat proxy-arp interface ge-0/0/0.0 address 2.2.2.5/32
(or)
delete security nat proxy-arp interface ge-0/0/0.0 address 2.2.2.5/32
There are no other viable workarounds for this issue.