An Incorrect Calculation of Buffer Size vulnerability in Juniper Networks Junos OS SRX 5000 Series devices using SPC2 line cards while ALGs are enabled allows an attacker sending specific crafted packets to cause a transit traffic Denial of Service (DoS).

Continued receipt and processing of these specific packets will sustain the Denial of Service condition.

This issue affects:
Juniper Networks Junos OS SRX 5000 Series with SPC2 with ALGs enabled.

• All versions earlier than 21.2R3-S7;
• 21.4 versions earlier than 21.4R3-S6;
• 22.1 versions earlier than 22.1R3-S5;
• 22.2 versions earlier than 22.2R3-S3;
• 22.3 versions earlier than 22.3R3-S2;
• 22.4 versions earlier than 22.4R3;
• 23.2 versions earlier than 23.2R2. 

Required configuration for exposure:

The following minimum configuration is required to be exposed to the issue:

  [security alg]

The following software releases have been updated to resolve this specific issue: 21.2R3-S7, 21.4R3-S6, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R3, 23.2R2, 23.4R1, and all subsequent releases.

This issue is being tracked as 1750148 which is visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• https://www.cve.org/CVERecord?id=CVE-2024-30405