Product Affected

This issue affects Junos OS 21.4, 22.1, 22.2, 22.3, 22.4, 23.2. This issue affects Junos OS Evolved 21.4-EVO, 22.1-EVO, 22.2-EVO, 22.3-EVO, 22.4-EVO, 23.2-EVO.
Medium
6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Problem

An Improper Validation of Syntactic Correctness of Input vulnerability in Routing Protocol Daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS).
 

When a malformed BGP UPDATE packet is received over an established BGP session, the rpd crashes and restarts.
 

This issue requires an attacker to have an established BGP session to a system affected by the issue. This issue affects both eBGP and iBGP implementations.
 

This issue affects:

Juniper Networks Junos OS

21.4 versions prior to 21.4R3-S4;

22.1 versions prior to 22.1R3-S3;

22.2 versions prior to 22.2R3-S2;

22.3 versions prior to 22.3R2-S2, 22.3R3;

22.4 versions prior to 22.4R2-S1, 22.4R3;

23.2 versions prior to 23.2R1, 23.2R2;


Juniper Networks Junos OS Evolved

21.4 versions prior to 21.4R3-S5-EVO;

22.1 versions prior to 22.1R3-S3-EVO;

22.2 versions prior to 22.2R3-S3-EVO;

22.3 versions prior to 22.3R2-S2-EVO;

22.4 versions prior to 22.4R3-EVO;

23.2 versions prior to 23.2R2-EVO;
 

The following minimal configuration is required:
[protocols bgp]
 

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.


This issue was found during internal product security testing or research.


This issue has been assigned CVE-2023-44204.

Solution

The following software releases have been updated to resolve this specific issue:

Junos OS: 21.4R3-S4, 22.1R3-S3, 22.2R3-S2, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3, 23.1R2, 23.2R1, 23.2R2, 23.3R1 and all subsequent releases.

Junos OS Evolved: 22.1R3-S3-EVO, 22.3R2-S2-EVO, 22.4R3-EVO, 23.1R2-EVO, 23.2R2-EVO, 23.3R1-EVO and all subsequent releases.
 

This issue is being tracked as PR 1731803 which is visible on the Customer Support website.


Note: Juniper SIRT's policy [juniper.net] is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Workaround

There are no known workarounds for this issue.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History

2023-10-11: Initial Publication

Related Information