An Improper Handling of Unexpected Data Type vulnerability in the handling of SIP calls in Juniper Networks Junos OS on SRX Series and MX Series platforms allows an attacker to cause a memory leak leading to Denial of Services (DoS).
 

This issue occurs on all MX Series platforms with MS-MPC/-MIC or SPC3 card, and all SRX Series platforms where SIP ALG is enabled. Successful exploitation of this vulnerability prevents additional SIP calls and applications from succeeding.

The SIP ALG needs to be enabled, either implicitly / by default or by way of configuration. To confirm whether SIP ALG is enabled on MX with SPC3 and SRX use the following command:

Please verify on MX whether the following is configured:

where either

or an application or application-set refers to SIP:

or

• All versions prior to 19.3R3-S7;
• 19.4 versions prior to 19.4R2-S8, 19.4R3-S10;
• 20.1 versions 20.1R1 and later versions;
• 20.2 versions prior to 20.2R3-S6;
• 20.3 versions prior to 20.3R3-S6;
• 20.4 versions prior to 20.4R3-S5;
• 21.1 versions prior to 21.1R3-S5;
• 21.2 versions prior to 21.2R3-S1;
• 21.3 versions prior to 21.3R3;
• 21.4 versions prior to 21.4R2-S2, 21.4R3;
• 22.1 versions prior to 22.1R1-S2, 22.1R2, 22.1R3-S1.

This issue does not affect Juniper Networks Junos OS on SRX Series and on MX Series:

• All versions prior to 18.2R1.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was seen during production usage.

This issue has been assigned CVE-2023-22394.

The following software releases have been updated to resolve this specific issue: 19.3R3-S7, 19.4R2-S8, 19.4R3-S10, 20.2R3-S6, 20.3R3-S6, 20.4R3-S5, 21.1R3-S5, 21.2R3-S1, 21.3R3, 21.4R2-S2, 21.4R3, 22.1R1-S2, 22.1R2, 22.1R3-S1, 22.2R1, 22.3R1, and all subsequent releases.

This issue is being tracked as 1653902.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

There are no known workarounds for this issue

2023-01-11: Initial Publication
2023-02-08: Modified JSA to include MX with SPC3 as affected

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2023-22394 at cve.mitre.org