A Heap-based Buffer Overflow vulnerability in the Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS). If an attacker sends a specific BGP UPDATE message to the device, this will cause a memory overwrite and therefore an RPD crash and restart in the backup Routing Engine (RE). Continued receipt of these packets will cause a sustained Denial of Service (DoS) condition in the backup RE. The primary RE is not impacted by this issue and there is no impact on traffic. This issue only affects devices with NSR enabled. Note: NSR is not supported on the SRX Series and is therefore not affected by this vulnerability. This issue requires an attacker to have an established BGP session
The following software releases have been updated to resolve this specific issue: Junos OS: 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S2, 22.3R3-S1, 22.4R2-S2, 22.4R3, 23.1R2, 23.2R1-S2, 23.2R2, 23.3R1, 23.4R1, and all subsequent releases. Junos OS Evolved: 21.3R3-S5-EVO, 21.4R3-S5-EVO, 22.1R3-S4-EVO, 22.2R3-S2-EVO, 22.4R2-S2-EVO, 22.4R3-EVO, 23.1R2-EVO, 23.2R1-S2-EVO, 23.2R2-EVO, 23.3R1-EVO, 23.4R1-EVO, and all subsequent releases.
There are no known workarounds for this issue.
| Product | Vulnerable range | Fixed version | Advisory |
|---|---|---|---|
| Juniper Networks Junos OS | <20.4R3-S9 | 20.4R3-S9 | advisory ↗ |
| Juniper Networks Junos OS | >=21.2<21.2R3-S7 | 21.2R3-S7 | advisory ↗ |
| Juniper Networks Junos OS | >=21.3<21.3R3-S5 | 21.3R3-S5 | advisory ↗ |
| Juniper Networks Junos OS | >=21.4<21.4R3-S5 | 21.4R3-S5 | advisory ↗ |
| Juniper Networks Junos OS | >=22.1<22.1R3-S4 | 22.1R3-S4 | advisory ↗ |
| Juniper Networks Junos OS | >=22.2<22.2R3-S2 | 22.2R3-S2 | advisory ↗ |
| Juniper Networks Junos OS | >=22.3<22.3R3-S1 | 22.3R3-S1 | advisory ↗ |
| Juniper Networks Junos OS | >=22.4<22.4R2-S2, 22.4R3 | 22.4R2-S2, 22.4R3 | advisory ↗ |
| Juniper Networks Junos OS | >=23.1<23.1R2 | 23.1R2 | advisory ↗ |
| Juniper Networks Junos OS | >=23.2<23.2R1-S2, 23.2R2 | 23.2R1-S2, 23.2R2 | advisory ↗ |
| Juniper Networks Junos OS Evolved | <21.3R3-S5-EVO | 21.3R3-S5-EVO | advisory ↗ |
| Juniper Networks Junos OS Evolved | >=21.4-EVO<21.4R3-S5-EVO | 21.4R3-S5-EVO | advisory ↗ |
| Juniper Networks Junos OS Evolved | >=22.1-EVO<22.1R3-S4-EVO | 22.1R3-S4-EVO | advisory ↗ |
| Juniper Networks Junos OS Evolved | >=22.2-EVO<22.2R3-S2-EVO | 22.2R3-S2-EVO | advisory ↗ |
| Juniper Networks Junos OS Evolved | >=22.4-EVO<22.4R2-S2-EVO, 22.4R3-EVO | 22.4R2-S2-EVO, 22.4R3-EVO | advisory ↗ |
| Juniper Networks Junos OS Evolved | >=23.1-EVO<23.1R2-EVO | 23.1R2-EVO | advisory ↗ |
| Juniper Networks Junos OS Evolved | >=23.2-EVO<23.2R1-S2-EVO, 23.2R2-EVO | 23.2R1-S2-EVO, 23.2R2-EVO | advisory ↗ |