An Incorrect Behavior Order vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on EX4300 Series allows an unauthenticated, network-based attacker to cause an integrity impact to networks downstream of the vulnerable device.

When an output firewall filter is applied to an interface it doesn't recognize matching packets but permits any traffic.

This issue affects Junos OS 21.4 releases from 21.4R1 earlier than 21.4R3-S6.
This issue doesn't not affect Junos OS releases earlier than 21.4R1.

To be affected by this issue an output firewall filter has to be configured on an interface like in the following example:

  [interfaces <interface> unit <unit> family <family> filter output <filter_name>]

The following software release has been updated to resolve this specific issue: 21.4R3-S6, and all subsequent releases of this branch.

This issue is being tracked as 1770410 which is visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

2024-04-10 - Initial Publication
2024-09-13: Minor formatting change to CVSS field

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• https://www.cve.org/CVERecord?id=CVE-2024-30389