Juniper Junos 16.1

Juniper Networks devices running affected Junos OS versions may be impacted by the receipt of a crafted BGP UPDATE which can lead to an rpd (routing process daemon) crash and restart. Repeated crashes of the rpd daemon can result in an extended denial of service condition. The affected Junos OS versions are: 15.1 prior to 15.1F2-S15, 15.1F5-S7, 15.1F6-S5, 15.1F7, 15.1R4-S7, 15.1R5-S2, 15.1R6; 15.1X49 prior to 15.1X49-D78, 15.1X49-D80; 15.1X53 prior to 15.1X53-D230, 15.1X53-D63, 15.1X53-D70; 16.1 prior to 16.1R3-S3, 16.1R4; 16.2 prior to 16.2R1-S3, 16.2R2; Releases prior to Junos OS 15.1 are unaffected by this vulnerability. 17.1R1, 17.2R1, and all subsequent releases have a resolution for this vulnerability.

An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field may cause a NULL pointer dereference and thus cause a denial of service, as demonstrated by the lack of a trailing ']' character in an IPv6 address.

Junos OS: Receipt of a specifically crafted malicious MPLS packet leads to a Junos kernel crash.

Junos: Denial of Service vulnerability in rpd daemon

Junos OS: RPD crash upon receipt of malformed PIM packet

Junos OS: rpd crash on VPLS PE upon receipt of specific BGP message

Junos OS: Denial of Service vulnerability in MS-PIC, MS-MIC, MS-MPC, MS-DPC and SRX flow daemon (flowd) related to SIP ALG

Junos OS: RPD process crashes when BGP peer restarts

Junos OS: Receipt of certain genuine BGP packets from any BGP Speaker causes RPD to crash.

Junos OS: A malformed IPv4 packet received by Junos in an NG-mVPN scenario may cause the routing protocol daemon (rpd) process to core

Junos OS: RPD process crashes upon receipt of a specific SNMP packet

Junos OS: MX Series: jdhcpd crash when receiving a specific crafted DHCP response message

Junos OS: MX Series: Denial of Service vulnerability in MS-PIC component on MS-MIC or MS-MPC

Junos OS: RPD process crashes due to specific BGP peer restarts condition.

BGP packets can trigger rpd crash when BGP tracing is enabled.

Junos OS: Denial of Service vulnerability in J-Web and web based (HTTP/HTTPS) services caused by a high number of specific requests

Junos OS: Upon receipt of certain types of malformed PCEP packets the pccd process may crash.

Junos: rpd core due to receipt of specially crafted BGP packet

Junos OS: Cross-Site Scripting (XSS) in J-Web

Junos OS: Upon receipt of certain protocol packets with invalid payloads a self-propagating Denial of Service may occur.

Junos OS: A race condition in the storm control profile may allow an attacker to cause a Denial of Service condition

Junos OS: commit script may allow unauthenticated root login upon reboot

Junos OS: 'set system ports console insecure' allows root password recovery on OAM volumes

Junos OS: EX and QFX Series: Console port authentication bypass vulnerability

On Juniper Networks devices running Junos OS affected versions and with LDP enabled, a specific LDP packet destined to the RE (Routing Engine) will consume a small amount of the memory allocated for the rpd (routing protocol daemon) process. Over time, repeatedly receiving this type of LDP packet(s) will cause the memory to exhaust and the rpd process to crash and restart. It is not possible to free up the memory that has been consumed without restarting the rpd process. This issue affects Junos OS based devices with either IPv4 or IPv6 LDP enabled via the [protocols ldp] configuration (the native IPv6 support for LDP is available in Junos OS 16.1 and higher). The interface on which the packet arrives needs to have LDP enabled. The affected Junos versions are: 13.3 prior to 13.3R10; 14.1 prior to 14.1R8; 14.2 prior to 14.2R7-S6 or 14.2R8; 15.1 prior to 15.1F2-S14, 15.1F6-S4, 15.1F7, 15.1R4-S7, 15.1R5; 15.1X49 before 15.1X49-D70; 15.1X53 before 15.1X53-D230, 15.1X53-D63, 15.1X53-D70; 16.1 before 16.1R2. 16.2R1 and all subsequent releases have a resolution for this vulnerability.

Junos OS: A specific SNMP command can trigger a high CPU usage Denial of Service in the RPD daemon.

Junos OS: PTX Series, QFX Series: Due to a race condition input loopback firewall filters applied to interfaces may not operate even when listed in the running configuration.

Junos Fusion: A Satellite Device can be controlled by rewiring it to a foreign AD causing a DoS

Junos OS: QFX10K Series, EX9200 Series, MX Series, PTX Series: Privilege escalation vulnerability in NG-RE.

Race condition in the RPC functionality in Juniper Junos OS before 12.1X44-D55, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R11, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R8, 13.2X51 before 13.2X51-D39, 13.3 before 13.3R7, 14.1 before 14.1R6, 14.1X53 before 14.1X53-D30, 14.2 before 14.2R3-S4, 15.1 before 15.1F2, or 15.1R2, 15.1X49 before 15.1X49-D20, and 16.1 before 16.1R1 allows local users to read, delete, or modify arbitrary files via unspecified vectors.

Junos OS: A crafted MPLS packet may lead to a kernel crash

Junos: EX Series PFE and MX MPC7E/8E/9E PFE crash when fetching interface stats with 'extended-statistics' enabled

Junos OS: EX4300/EX4600/QFX3500/QFX5100 Series: Stateless IP firewall filter may fail to evaluate certain packets

Junos OS: Kernel memory leak in virtual-memory due to interface flaps

Junos OS: EX Series, QFX Series, SRX Branch Series, MX Series: Memory leak in packet forwarding engine due to 802.1X authenticator port interface flaps

Junos OS: bbe-smgd process denial of service while processing VLAN authentication requests/rejects

PKId in Juniper Junos OS before 12.1X44-D52, 12.1X46 before 12.1X46-D37, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R12, 12.3X48 before 12.3X48-D20, 13.3 before 13.3R10, 14.1 before 14.1R8, 14.1X53 before 14.1X53-D40, 14.2 before 14.2R7, 15.1 before 15.1R4, 15.1X49 before 15.1X49-D20, 15.1X53 before 15.1X53-D60, and 16.1 before 16.1R1 allow remote attackers to bypass an intended certificate validation mechanism via a self-signed certificate with an Issuer name that matches a valid CA certificate enrolled in Junos.

Junos OS: EX4300 Series: Denial of Service upon receipt of large number of specific valid packets on management interface.

QFX5000/EX4600 Series: Routing protocol flap upon receipt of high rate of Ethernet frames

MX Series: L2ALD daemon may crash if a duplicate MAC is learned by two different interfaces