An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to send arbitrary data to the device, which leads msvcsd process to crash with limited availability impacting Denial of Service (DoS) and allows unauthorized network access to the device, potentially impacting system integrity.

This issue only happens when inline jflow is configured.

This does not impact any forwarding traffic. The impacted services MSVCS-DB app crashes momentarily and recovers by itself. 

This issue affects Juniper Networks Junos OS Evolved: 

• 21.4 versions earlier than 21.4R3-S7-EVO; 
• 22.2 versions earlier than 22.2R3-S3-EVO;
• 22.3 versions earlier than 22.3R3-S2-EVO;
• 22.4 versions earlier than 22.4R3-EVO;
• 23.2 versions earlier than 23.2R1-S2-EVO, 23.2R2-EVO.

Required configuration for exposure:

This issue only happens when inline jflow is configured:

 [ services flow-monitoring (version-ipfix|version9) ]
 [ forwarding-options sampling instance 1 input rate 33333]
 [ forwarding-options sampling instance 1 family inet output flow-server x.x.x.x port 9991]
 [ forwarding-options sampling instance 1 family inet output flow-server x.x.x.x version9 template 1]
 [ forwarding-options sampling instance 1 family inet output inline-jflow source-address y.y.y.y]

The following software releases have been updated to resolve this specific issue: 

Junos OS Evolved: 21.4R3-S7-EVO, 22.2R3-S3-EVO, 22.3R3-S2-EVO, 22.4R3-EVO, 23.2R1-S2-EVO, 23.2R2-EVO, 23.4R1-EVO, and all subsequent releases.

This issue is being tracked as 1763417 which is visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

2024-07-10: Initial Publication
2024-09-13: Minor formatting change to CVSS field

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team