Product Affected

This issue affects all versions of Junos OS. Affected platforms: MX Series, SRX Series.
High
7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Problem

An Improper Validation of Syntactic Correctness of Input vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service (DoS).


On all Junos OS MX Series and SRX Series platforms, when SIP ALG is enabled, and a specific SIP packet is received and processed, NAT IP allocation fails for genuine traffic, which causes Denial of Service (DoS). Continuous receipt of this specific SIP ALG packet will cause a sustained DoS condition.


NAT IP usage can be monitored by running the following command.

user@srx> show security nat resource-usage source-pool <source_pool_name>

 

Pool name: source_pool_name
..
Address Factor-index Port-range Used Avail Total Usage
X.X.X.X
0 Single Ports 50258 52342 62464 96% <<<<<
- Alg Ports 0 2048 2048 0%


This issue affects:

Junos OS on MX Series and SRX Series

  • All versions earlier than 21.2R3-S6;
  • 21.3 versions earlier than 21.3R3-S5;
  • 21.4 versions earlier than 21.4R3-S5;
  • 22.1 versions earlier than 22.1R3-S4;
  • 22.2 versions earlier than 22.2R3-S3;
  • 22.3 versions earlier than 22.3R3-S1;
  • 22.4 versions earlier than 22.4R2-S2, 22.4R3;
  • 23.2 versions earlier than 23.2R1-S1, 23.2R2.


To be affected the SIP ALG needs to be enabled, either implicitly / by default or by way of configuration.

Please verify on SRX with:

user@host> show security alg status | match sip
SIP : Enabled


Please verify on MX whether the following is configured:

user@host> show security alg status | match sip
SIP : Enabled
[services ... rule <rule-name> (term <term-name> ) from/match application/application-set <name>]

where either

a. name = junos-sip

or an application or application-set refers to SIP:

b. [applications application <name> application-protocol sip]

or

c. [applications application-set <name> application junos-sip]


Juniper SIRT is not aware of any malicious exploitation of this vulnerability.


This issue was seen during production usage.


This issue has been assigned CVE-2024-21616.

Solution

The following software releases have been updated to resolve this specific issue: 21.2R3-S6, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S3, 22.3R3-S1, 22.4R2-S2, 22.4R3, 23.2R1-S1, 23.2R2, 23.4R1, and all subsequent releases.


This issue is being tracked as PR 1702811 which is visible on the Customer Support website.


Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Workaround

There are no known workarounds for this issue, but it should be considered to disable the SIP ALG if it's not strictly needed.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History

2024-01-10: Initial Publication

Related Information


CVSS v4.0 Score: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N )