Article Detail

Product Affected

This issue affects all versions of Junos OS before 20.4R3-S5, 21.1, 21.2, 21.3, 21.4, 22.1, 22.2, 22.3. Affected platforms: MX Series.

Severity

Medium

Severity Assessment (CVSS) Score

CVSS 3.1: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

CVSS 4.0: 6.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)

Problem

A Use After Free vulnerability in command processing of Juniper Networks Junos OS on MX Series allows a local, authenticated attacker to cause the broadband edge service manager daemon (bbe-smgd) to crash upon execution of specific CLI commands, creating a Denial of Service (DoS) condition. The process crashes and restarts automatically.

When specific CLI commands are executed, the bbe-smgd daemon attempts to write into an area of memory (mgd socket) that was already closed, causing the process to crash. This process manages and controls the configuration of broadband subscriber sessions and services. While the process is unavailable, additional subscribers will not be able to connect to the device, causing a temporary Denial of Service condition.

This issue only occurs if Graceful Routing Engine Switchover (GRES) and Subscriber Management are enabled.

This issue affects Junos OS:

All versions before 20.4R3-S5,
from 21.1 before 21.1R3-S4,
from 21.2 before 21.2R3-S3,
from 21.3 before 21.3R3-S5,
from 21.4 before 21.4R3-S5,
from 22.1 before 22.1R3,
from 22.2 before 22.2R3,
from 22.3 before 22.3R2;

Subscriber Services (Broadband Edge) and GRES must be enabled to be vulnerable to this issue:

[edit system services] subscriber-management enable; [edit chassis redundancy] graceful-switchover;

Solution

The following software releases have been updated to resolve this specific issue: Junos OS: 20.4R3-S5, 21.1R3-S4, 21.2R3-S3, 21.3R3-S5, 21.4R3-S5, 22.1R3, 22.2R3, 22.3R2, 22.4R1, and all subsequent releases.

This issue is being tracked as 1688750 which is visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Workaround

Use access lists or firewall filters to limit access to the CLI only from trusted hosts and administrators.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories.

Modification History