An Off-by-one Error vulnerability in the nginx [engine x] resolver as used in Juniper Networks NorthStar Controller allows an unauthenticated remote attacker who is able to forge UDP packets from the DNS server to cause a 1-byte memory overwrite, resulting in worker process crash or potentially, arbitrary code execution. nginx as used in NorthStar Controller was upgraded from 1.18.0 to 1.20.1.

This issue affects:

Juniper Networks NorthStar Controller

• All versions prior to 5.1.0 Service Pack 6;
• 6 versions prior to 6.2.2.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was discovered during external security research.

This issue has been assigned CVE-2021-23017.

The following software releases have been updated to resolve these specific issues: 5.1.0 Service Pack 6, 6.2.2, and all subsequent releases.

Additionally, for NorthStar 6.0.0, 6.0.1, 6.0.2, 6.1.0, 6.2.0, 6.2.1, customers may install security patch NorthStar_6.x.x-Patch-SECURITY-nginx1.20.1-20220131_221547-8450ce7_14.x86_64.rpm to resolve this specific issue.

This issue is being tracked as 1644981.

Note: Juniper SIRT's policy  is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Implementation

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.
• http://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html
• https://lists.apache.org/thread.html/r37e6b2165f7c910d8e15fd54f4697857619ad2625f56583802004009@%3Cnotifications.apisix.apache.org%3E
• https://lists.apache.org/thread.html/r4d4966221ca399ce948ef34884652265729d7d9ef8179c78d7f17e7f@%3Cnotifications.apisix.apache.org%3E
• https://lists.apache.org/thread.html/r6fc5c57b38e93e36213e9a18c8a4e5dbd5ced1c7e57f08a1735975ba@%3Cnotifications.apisix.apache.org%3E
• https://lists.apache.org/thread.html/rf232eecd47fdc44520192810560303073cefd684b321f85e311bad31@%3Cnotifications.apisix.apache.org%3E
• https://lists.apache.org/thread.html/rf318aeeb4d7a3a312734780b47de83cefb7e6995da0b2cae5c28675c@%3Cnotifications.apisix.apache.org%3E
• https://nginx.org/en/CHANGES-1.20