On Juniper Networks Junos OS Evolved devices where ntp is enabled a crafted malicious authenticated mode 6 packet from a permitted network address can trigger a NULL pointer dereference. Note for this attack to work, the sending system must be on an address from which the target ntpd accepts mode 6 packets, and must use a private key that is specifically listed as being used for mode 6 authorization. The ntpd daemon can crash due to the NULL pointer dereference, causing a Denial of Service (DoS).

Continued receipt and processing of these crafted malicious packets will create a sustained Denial of Service (DoS) condition.

This issue affects:

Juniper Networks Junos OS Evolved

• All versions prior to 20.4R2-S2-EVO;
• 21.1 versions prior to 21.1R2-EVO;
• 21.2 versions prior to 21.2R1-EVO.

The following minimal configuration example is provided:

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was discovered during external security research.

This issue has been assigned  CVE-2019-8936 .

The following software releases have been updated to resolve this specific issue: Junos OS Evolved: 20.4R2-S2-EVO, 21.1R2-EVO, 21.2R1-EVO, and all subsequent releases.

This issue is being tracked as  1589449 .

Software releases or updates are available for download at https://support.juniper.net/support/downloads/
 

2021-07-14: Initial Publication.

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2019-8936: Junos OS Evolved: Authenticated denial of service in ntpd