When user-defined ARP Policer is configured and applied on one or more Aggregated Ethernet (AE) interface units, a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability between the Device Control Daemon (DCD) and firewall process (dfwd) daemons of Juniper Networks Junos OS allows an attacker to bypass the user-defined ARP Policer. In this particular case the User ARP policer is replaced with default ARP policer. To review the desired ARP Policers and actual state one can run the command "show interfaces <> extensive" and review the output. See further details below. An example output is: show interfaces extensive | match policer Policer: Input: __default_arp_policer__ <<< incorrect if user ARP Policer was applied on an AE interface and the default ARP Policer is displayed Policer
The following software releases have been updated to resolve this specific issue: For all platforms, except SRX Series, using Junos OS 15.1R7-S10, 18.4R2-S9, 18.4R3-S9, 19.4R3-S4, 20.1R3, 20.2R3-S2, 20.4R3, 21.1R2, 21.2R1, and all subsequent releases. On SRX series using Junos OS 18.4R2-S9, 18.4R3-S9, 19.4R3-S4. 20.1R3, 20.4R3, 21.1R2, 21.2R1, and all subsequent releases.
There is no workaround for this issue. If affected by this issue, to recover from its impact, restart the firewall process to update the ARP Policer on the AE interface unit(s). From the CLI issue: cli> restart firewall Note: no side effects on firewall restart shall be seen when issuing this command.
| Product | Vulnerable range | Fixed version | Advisory |
|---|---|---|---|
| Juniper Networks Junos OS | >=15.1<15.1R7-S10 | 15.1R7-S10 | advisory ↗ |
| Juniper Networks Junos OS | >=16.1R1<16.1* | 16.1* | advisory ↗ |
| Juniper Networks Junos OS | >=16.2R1<16.2* | 16.2* | advisory ↗ |
| Juniper Networks Junos OS | >=17.1R1<17.1* | 17.1* | advisory ↗ |
| Juniper Networks Junos OS | >=17.2R1<17.2* | 17.2* | advisory ↗ |
| Juniper Networks Junos OS | >=17.3R1<17.3* | 17.3* | advisory ↗ |
| Juniper Networks Junos OS | >=17.4R1<17.4* | 17.4* | advisory ↗ |
| Juniper Networks Junos OS | >=18.1R1<18.1* | 18.1* | advisory ↗ |
| Juniper Networks Junos OS | >=18.2R1<18.2* | 18.2* | advisory ↗ |
| Juniper Networks Junos OS | >=18.3R1<18.3* | 18.3* | advisory ↗ |
| Juniper Networks Junos OS | >=18.4<18.4R2-S9, 18.4R3-S9 | 18.4R2-S9, 18.4R3-S9 | advisory ↗ |
| Juniper Networks Junos OS | >=19.4<19.4R3-S3 | 19.4R3-S3 | advisory ↗ |
| Juniper Networks Junos OS | >=20.1<20.1R3 | 20.1R3 | advisory ↗ |
| Juniper Networks Junos OS | >=20.2<20.2R3-S2 | 20.2R3-S2 | advisory ↗ |
| Juniper Networks Junos OS | >=20.3R1<20.3* | 20.3* | advisory ↗ |
| Juniper Networks Junos OS | >=20.4<20.4R3 | 20.4R3 | advisory ↗ |
| Juniper Networks Junos OS | >=21.1<21.1R2 | 21.1R2 | advisory ↗ |
| Juniper Networks Junos OS | >=5.6R1<5.6* | 5.6* | advisory ↗ |