Multiple vulnerabilities in SQLite as used in Juniper Networks Junos OS and Junos OS Evolved have been resolved by upgrading SQLite from 3.31.1 to 3.37.0.

Services that rely upon SQLite are the Connectivity Fault Management (CFM) Daemon (CFDM), AppID, IDP, Apache2, J-Web, and JSQL as used by IPID, SecIntel Threat Intelligence, useridd, accounts, processes and services.

These services are all exposed to potentially exploitable Denial of Service (DoS) attacks which may be exploited by a remote unauthenticated attacker sending packets to the device.

An attacker may be able to sustain the Denial of Service (DoS) condition by sending subsequent packets.

These issues affect:

Juniper Networks Junos OS

• 15.1X49 version 15.1X49-D100 and all subsequent versions prior to 19.2R3-S5;
• 19.3 versions prior to 19.3R3-S6;
• 19.4 versions prior to 19.4R2-S6, 19.4R3-S8;
• 20.1 versions prior to 20.1R3-S4;
• 20.2 versions prior to 20.2R3-S4;
• 20.3 versions prior to 20.3R3-S3;
• 20.4 versions prior to 20.4R3-S3;
• 21.1 versions prior to 21.1R3-S1;
• 21.2 versions prior to 21.2R2-S2;
• 21.3 versions prior to 21.3R2;
• 21.4 versions prior to 21.4R1-S1, 21.4R2.

These issues are not applicable to versions prior to 15.1X49-D100.

Juniper Networks Junos OS Evolved

• All versions prior to 21.2R3-EVO;
• 21.3 versions prior to 21.3R3-EVO;
• 21.4 versions prior to 21.4R2-EVO.

Juniper SIRT is not aware of any malicious exploitation of these vulnerabilities.

These issues were discovered during external security research.

Note: An assessment was completed as listed in the 3.37.1 vs 3.37.2 change log for the lang_upsert incorrect byte-code leading to NULL-pointer dereference and the FTS5 OOB read related to reading corrupt database file and Junos OS and Junos OS Evolved are not affected by these noted issues.

Note: CVE-2021-36690: This bug is not in the SQLite core library, but rather in an experimental extension that is used to implement the .expert command in the CLI. The code that contains the bug does not appear in standard SQLite builds, though it is included in the sqlite3.exe command-line tool. Applications must link against the extra source code files that implement the extension and take other deliberate actions to activate the extension before the troublesome code can be run. For the rare application that uses the troublesome extension, the consequence of this bug is that malicious SQL can cause a NULL pointer deference and denial of service.

Note: CVE-2020-11656: This issue requires compilation of SQLite with debug mode enabled. Juniper Networks does not enable SQLite debug mode.

Important security issues resolved include:

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

These issues are being tracked as 1583420.

Implementation

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• https://www.sqlite.org/cves.html
• https://sqlite.org/releaselog/3_37_0.html
• https://sqlite.org/releaselog/3_37_2.html