Juniper Junos

On Juniper Networks devices running Junos OS affected versions and with LDP enabled, a specific LDP packet destined to the RE (Routing Engine) will consume a small amount of the memory allocated for the rpd (routing protocol daemon) process. Over time, repeatedly receiving this type of LDP packet(s) will cause the memory to exhaust and the rpd process to crash and restart. It is not possible to free up the memory that has been consumed without restarting the rpd process. This issue affects Junos OS based devices with either IPv4 or IPv6 LDP enabled via the [protocols ldp] configuration (the native IPv6 support for LDP is available in Junos OS 16.1 and higher). The interface on which the packet arrives needs to have LDP enabled. The affected Junos versions are: 13.3 prior to 13.3R10; 14.1 prior to 14.1R8; 14.2 prior to 14.2R7-S6 or 14.2R8; 15.1 prior to 15.1F2-S14, 15.1F6-S4, 15.1F7, 15.1R4-S7, 15.1R5; 15.1X49 before 15.1X49-D70; 15.1X53 before 15.1X53-D230, 15.1X53-D63, 15.1X53-D70; 16.1 before 16.1R2. 16.2R1 and all subsequent releases have a resolution for this vulnerability.

Junos OS: SRX, vSRX Series: J-Web Path traversal vulnerability in SRX and vSRX Series leads to information disclosure.

Junos OS: A specific SNMP command can trigger a high CPU usage Denial of Service in the RPD daemon.

Junos OS: Privilege escalation in J-Web due to arbitrary command and code execution via information disclosure from another users active session

Junos OS: A specific BGP VPNv6 flowspec message causes routing protocol daemon (rpd) process to crash with a core.

Junos: QFX Series: Insufficient entropy on QFX3500 and QFX3600 platforms when the system boots up

Junos OS: PTX Series, QFX Series: Due to a race condition input loopback firewall filters applied to interfaces may not operate even when listed in the running configuration.

Junos OS: NFX Series: 'set system ports console insecure' allows root password recovery

Junos Fusion: A Satellite Device can be controlled by rewiring it to a foreign AD causing a DoS

Junos OS: SRX Series: Low privileged user able to access sensitive information on file system

Junos OS: MX304, MX with MPC10/11/LC9600, and EX9200 with EX9200-15C: In a VPLS or Junos Fusion scenario specific show commands cause FPCs to crash

Junos OS: MX Series: The PFE will crash on running specific command

Junos OS and Junos OS Evolved: A local, low privileged user can access sensitive information

Junos OS: EX4300 Series: If a specific CLI command is issued PFE crashes will occur

Junos OS: SRX Series: Low privileged user able to access highly sensitive information on file system

Junos OS and Junos OS Evolved: Executing a specific CLI command when asregex-optimized is configured causes an rpd crash

Junos OS: SRX1500,SRX4100,SRX4200: Execution of low-privileged CLI command results in chassisd crash

Junos OS: The 802.1X Authentication Daemon crashes on running a specific command

Junos OS and Junos OS Evolved: A specific CLI command will cause an RPD crash when rib-sharding and update-threading is enabled

Junos OS and Junos OS Evolved: Executing a specific show command leads to an rpd crash

Junos OS: A specifically crafted 'show chassis' command causes chassisd to crash

Junos OS and Junos OS Evolved: EX Series, QFX Series, MX Series: A specific 'show l2-learning/ethernet-switching' command causes l2ald crash

Junos OS: A low-privileged user can disable an interface

Junos OS: SRX1600, SRX2300, SRX4300: When a specific show command is executed chassisd crashes

Junos OS: SRX1500, SRX4100, SRX4200, SRX4600: When a specific show command is executed chassisd crashes

Junos OS and Junos OS Evolved: Unix socket used to control the jdhcpd process is world-writable

Junos OS and Junos OS Evolved: Specific low privileged CLI command exposes sensitive information

Junos OS: EX Series: Unauthorized users can execute service-impacting CLI command

Junos OS and Junos OS Evolved: Annotate configuration command can be used to change the configuration

Junos OS and Junos OS Evolved: When RIB sharding is configured each time a show command is executed RPD memory leaks

Junos OS: MX10k Series: 'show system firmware' CLI command may lead to LC480 or LC2101 line card reset

Junos OS: An local attacker with shell access can execute arbitrary code

Junos OS: QFX10K Series, EX9200 Series, MX Series, PTX Series: Privilege escalation vulnerability in NG-RE.

Race condition in the RPC functionality in Juniper Junos OS before 12.1X44-D55, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R11, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R8, 13.2X51 before 13.2X51-D39, 13.3 before 13.3R7, 14.1 before 14.1R6, 14.1X53 before 14.1X53-D30, 14.2 before 14.2R3-S4, 15.1 before 15.1F2, or 15.1R2, 15.1X49 before 15.1X49-D20, and 16.1 before 16.1R1 allows local users to read, delete, or modify arbitrary files via unspecified vectors.

Junos OS and Junos OS Evolved: Configuration of a specific SSH option results in mgd crash

Junos OS: EX4600 Series and QFX5000 Series: Receipt of specific traffic will lead to an fxpc process crash followed by an FPC reboot

Junos OS and Junos OS Evolved: A vulnerability allows a network based unauthenticated attacker which sends a high rate of specific traffic to cause a partial Denial of Service

Juniper Junos OS before 13.3R9, 14.1R6 before 14.1R6-S1, and 14.1 before 14.1R7, when configured with VPLS routing-instances, allows remote attackers to obtain sensitive mbuf information by injecting a flood of Ethernet frames with IPv6 MAC addresses directly into a connected interface.

Junos OS: A crafted MPLS packet may lead to a kernel crash

Junos: EX Series PFE and MX MPC7E/8E/9E PFE crash when fetching interface stats with 'extended-statistics' enabled