An uncontrolled resource consumption vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series switches allows an attacker, which is sending large amounts of legitimate traffic destined to the device, to cause Interchassis Control Protocol (ICCP) interruptions leading to an unstable control connection between the MC-LAG nodes which can in turn lead to traffic loss.

Continued receipt of this amount of traffic will create a sustained Denial of Service (DoS) condition.

An indication that the system could be impacted by this issue is the following log message:

This issue affects Juniper Networks Junos OS on QFX5000 Series and EX4600 Series:

• 15.1 versions prior to 15.1R7-S9;
• 17.3 versions prior to 17.3R3-S11;
• 17.4 versions prior to 17.4R2-S13, 17.4R3-S5;
• 18.3 versions prior to 18.3R3-S5;
• 18.4 versions prior to 18.4R2-S8, 18.4R3-S7;
• 19.1 versions prior to 19.1R3-S5;
• 19.2 versions prior to 19.2R1-S6, 19.2R3-S2;
• 19.3 versions prior to 19.3R2-S6, 19.3R3-S2;
• 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3-S2;
• 20.1 versions prior to 20.1R2-S2, 20.1R3;
• 20.2 versions prior to 20.2R2-S3, 20.2R3;
• 20.3 versions prior to 20.3R2;
• 20.4 versions prior to 20.4R1-S1, 20.4R2.

This issue only affects devices with ICCP configured:

[ protocols iccp peer ]

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was seen during production usage.

This issue has been assigned  CVE-2021-0285 .
 

The following software releases have been updated to resolve this specific issue: Junos OS 15.1R7-S9, 17.3R3-S11, 17.4R2-S13, 17.4R3-S5, 18.1R3-S13, 18.2R3-S8, 18.3R3-S5, 18.4R2-S8, 18.4R3-S7, 19.1R3-S5, 19.2R1-S6, 19.2R3-S2, 19.3R2-S6, 19.3R3-S2, 19.4R1-S4, 19.4R2-S4, 19.4R3-S2, 20.1R2-S2, 20.1R3, 20.2R2-S3, 20.2R3, 20.3R2, 20.4R1-S1, 20.4R2, 21.1R1, and all subsequent releases.

This issue is being tracked as  1552877 .
 

Software releases or updates are available for download at https://support.juniper.net/support/downloads/
 

2021-07-14: Initial Publication.

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2021-0285: Continuous traffic destined to a device configured with MC-LAG leading to nodes losing their control connection which can impact traffic