An Access of Uninitialized Pointer vulnerability in the SIP ALG of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause a Denial of Service (DoS). Continued receipt of these specific packets will cause a sustained Denial of Service condition.
 

On all MX and SRX platforms, if the SIP ALG is enabled, an MS-MPC or MS-MIC, or SPC will crash if it receives a SIP message with a specific contact header format.

This issue affects Juniper Networks Junos OS on MX Series and SRX Series:

• 20.4 versions prior to 20.4R3;
• 21.1 versions prior to 21.1R2-S1, 21.1R3;
• 21.2 versions prior to 21.2R2.

This issue does not affect versions prior to 20.4R1.
 

To be affected the SIP ALG needs to be enabled, either implicitly / by default or by way of configuration. Please verify on SRX with:

Please verify on MX whether the following is configured:

where either

a. name = junos-sip or

an application or application-set refers to SIP:

b. [ applications application <name> application-protocol sip ] or

c. [ applications application-set <name> application junos-sip ]

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
 

This issue was seen during production usage.
 

This issue has been assigned CVE-2022-22198.

The following software releases have been updated to resolve this specific issue: 20.4R3, 21.1R2-S1, 21.1R3, 21.2R2, 21.3R1, and all subsequent releases.
 

This issue is being tracked as PR 1612450 which is visible on the Customer Support website.
 

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).
 

Implementation:

Software Releases, patches and updates are available at https://support.juniper.net/support/downloads/

There are no viable workarounds for this issue, but it should be considered to disable the SIP ALG if it's not strictly needed.

• 2022-04-13: Initial Publication.

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2022-22198 at cve.mitre.org