Juniper Junos

Junos OS and Junos OS Evolved: In an EVPN-VXLAN scenario specific ARP or NDP packets cause FPC to crash

Junos OS and Junos OS Evolved: Receipt of specific IS-IS update packet causes memory leak leading to RPD crash

Junos OS and Junos OS Evolved: Memory leak due to RSVP neighbor persistent error leading to kernel crash

Junos OS and Junos OS Evolved: Receiving specific traffic on devices with EVPN-VPWS with IGMP-snooping enabled will cause the rpd to crash

Junos OS and Junos OS Evolved: Upon processing specific L2 traffic, rpd can hang in devices with EVPN/VXLAN configured

Junos OS and Junos OS Evolved: Receipt of a malformed LLDP TLV results in l2cpd crash

Junos OS: MX Series: Subscriber login/logout activity will lead to a memory leak

Junos OS and Junos OS Evolved: With certain BGP options enabled, receipt of specifically malformed BGP update causes RPD crash

Junos OS and Junos OS Evolved: Receipt of specially crafted BGP update packet causes RPD crash

Junos OS and Junos OS Evolved: On SRv6 enabled devices, an attacker sending a malformed BGP update can cause the rpd to crash

Junos OS and Junos OS Evolved: A high frequency of connecting and disconnecting NETCONF sessions causes management unavailability

Junos OS: ACX5448 & ACX710: Due to interface flaps the PFE process can crash

Junos OS and Junos OS Evolved: Denial of Service vulnerability in local file processing

Junos OS and Junos OS Evolved: Loading a malicious certificate from the CLI may result in a stack-based overflow

Junos OS: EX4600 Series and QFX5000 Series: An attacker with physical access can open a persistent backdoor

Junos OS and Junos OS Evolved: Higher CPU consumption on routing engine leads to Denial of Service (DoS).

Junos OS: SRX Series: If VPN compliance-check is configured an attacker can cause http-gk process crash

Junos OS and Junos OS Evolved: Optional transitive BGP attribute is modified before propagation to peers causing sessions to flap

Junos OS: MX with SPC3, SRX Series: Repeated VPN negotiation failures will eventually cause iked to crash continuously

Junos OS: Processing of a specific BGP update causes the SRRD process to crash

Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D15, and 12.3X48 before 12.3X48-D10 on SRX series devices does not properly enforce the log-out-on-disconnect feature when configured in the [system port console] stanza, which allows physically proximate attackers to reconnect to the console port and gain administrative access by leveraging access to the device.

Junos OS: MX Series: Web filtering doesn't block specifically formatted URLs

Junos OS: EX4300 Series: Firewall filter not blocking egress traffic

Junos OS: EX4300 Series: Loopback filter not blocking traffic despite having discard term.

Junos OS: EX and QFX Series: Console port authentication bypass vulnerability

Juniper Junos OS before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R7, 13.2X51 before 13.2X51-D35, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.1X50 before 14.1X50-D105, 14.1X51 before 14.1X51-D70, 14.1X53 before 14.1X53-D25, 14.1X55 before 14.1X55-D20, 14.2 before 14.2R1, 15.1 before 15.1F2 or 15.1R1, and 15.1X49 before 15.1X49-D10 does not require a password for the root user when pam.conf is "corrupted," which allows local users to gain root privileges by modifying the file.

Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D25, 12.1X47 before 12.1X47-D15, 12.3 before 12.3R9, 13.1 before 13.1R4-S3, 13.2 before 13.2R6, 13.3 before 13.3R5, 14.1 before 14.1R3, and 14.2 before 14.2R1 does not properly handle double quotes in authorization attributes in the TACACS+ configuration, which allows local users to bypass the security policy and execute commands via unspecified vectors.

Junos OS: IPv6 firewall filter fails to match payload-protocol

Junos OS: SRX4600, SRX5000 Series: TCP packets with SYN/FIN or SYN/RST are transferred after enabling no-syn-check with Express Path

Junos OS: EX Series, QFX Series: If the same egress filter is configured on both an IRB and a physical interface one of those is not applied

Junos OS: QFX5000 Series and EX4600 Series: Output firewall filter is not applied if certain match criteria are used

Junos OS: When a user with the name ftp or anonymous is configured unauthenticated filesystem access is allowed

Junos OS and Junos OS Evolved: BGP update message containing aggregator attribute with an ASN value of zero (0) is accepted

Junos OS: MX Series: Firewall filters on lo0.<non-0> in the default routing instance are not in effect

Junos OS: SRX Series: J-Web can be exposed on additional interfaces

Junos OS: MX Series: bbe-smgd process crash upon execution of specific CLI commands

named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.

Buffer overflow in the flow daemon (flowd) in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R7-S2, 12.1.X44 before 12.1X44-D15, 12.1X45 before 12.1X45-D10 on SRX devices, when using telnet pass-through authentication on the firewall, might allow remote attackers to execute arbitrary code via a crafted telnet message.

DNS forwarders - cache poisoning vulnerability

The Juniper SRX Series devices with Junos 11.4 before 11.4R12-S4, 12.1X44 before 12.1X44-D40, 12.1X45 before 12.1X45-D30, 12.1X46 before 12.1X46-D25, and 12.1X47 before 12.1X47-D10, when an Application Layer Gateway (ALG) is enabled, allows remote attackers to cause a denial of service (flowd crash) via a crafted packet.