A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) of Juniper Networks Junos OS on the QFX10K Series switches allows an attacker to trigger a packet forwarding loop, leading to a partial Denial of Service (DoS). The issue is caused by DVMRP packets looping on a multi-homed Ethernet Segment Identifier (ESI) when VXLAN is configured. DVMRP packets received on a multi-homed ESI are sent to the peer, and then incorrectly forwarded out the same ESI, violating the split horizon rule. This issue only affects QFX10K Series switches, including the QFX10002, QFX10008, and QFX10016. Other products and platforms are unaffected by this vulnerability. This issue affects Juniper Networks Junos OS on QFX10K Series: 17.3 versions prior to 17.3R3-S12; 17.4 versions prior to 17.4R3-S5; 18.1 versions prior to 18.1R3-S13; 18.2 version 18.2R1 and later versions; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R2-S9, 18.4R3-S8; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R1-S7, 19.2R3-S2; 19.3 versions prior to 19.3R3-S2; 19.4 versions prior to 19.4R3-S3; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R3; 20.3 versions prior to 20.3R3; 20.4 versions prior to 20.4R2.
Weakness
The product compares two entities in a security-relevant context, but the comparison is incorrect.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Junos | Juniper | 17.3 (including) | 17.3 (including) |
| Junos | Juniper | 17.3-r1 (including) | 17.3-r1 (including) |
| Junos | Juniper | 17.3-r1-s1 (including) | 17.3-r1-s1 (including) |
| Junos | Juniper | 17.3-r1-s4 (including) | 17.3-r1-s4 (including) |
| Junos | Juniper | 17.3-r2 (including) | 17.3-r2 (including) |
| Junos | Juniper | 17.3-r2-s1 (including) | 17.3-r2-s1 (including) |
| Junos | Juniper | 17.3-r2-s2 (including) | 17.3-r2-s2 (including) |
| Junos | Juniper | 17.3-r2-s3 (including) | 17.3-r2-s3 (including) |
| Junos | Juniper | 17.3-r2-s4 (including) | 17.3-r2-s4 (including) |
| Junos | Juniper | 17.3-r2-s5 (including) | 17.3-r2-s5 (including) |
| Junos | Juniper | 17.3-r3 (including) | 17.3-r3 (including) |
| Junos | Juniper | 17.3-r3-s1 (including) | 17.3-r3-s1 (including) |
| Junos | Juniper | 17.3-r3-s10 (including) | 17.3-r3-s10 (including) |
| Junos | Juniper | 17.3-r3-s11 (including) | 17.3-r3-s11 (including) |
| Junos | Juniper | 17.3-r3-s2 (including) | 17.3-r3-s2 (including) |
| Junos | Juniper | 17.3-r3-s3 (including) | 17.3-r3-s3 (including) |
| Junos | Juniper | 17.3-r3-s4 (including) | 17.3-r3-s4 (including) |
| Junos | Juniper | 17.3-r3-s5 (including) | 17.3-r3-s5 (including) |
| Junos | Juniper | 17.3-r3-s6 (including) | 17.3-r3-s6 (including) |
| Junos | Juniper | 17.3-r3-s7 (including) | 17.3-r3-s7 (including) |
| Junos | Juniper | 17.3-r3-s8 (including) | 17.3-r3-s8 (including) |
| Junos | Juniper | 17.3-r3-s9 (including) | 17.3-r3-s9 (including) |
| Junos | Juniper | 17.4 (including) | 17.4 (including) |
| Junos | Juniper | 17.4-r1 (including) | 17.4-r1 (including) |
| Junos | Juniper | 17.4-r1-s1 (including) | 17.4-r1-s1 (including) |
| Junos | Juniper | 17.4-r1-s2 (including) | 17.4-r1-s2 (including) |
| Junos | Juniper | 17.4-r1-s3 (including) | 17.4-r1-s3 (including) |
| Junos | Juniper | 17.4-r1-s4 (including) | 17.4-r1-s4 (including) |
| Junos | Juniper | 17.4-r1-s5 (including) | 17.4-r1-s5 (including) |
| Junos | Juniper | 17.4-r1-s6 (including) | 17.4-r1-s6 (including) |
| Junos | Juniper | 17.4-r1-s7 (including) | 17.4-r1-s7 (including) |
| Junos | Juniper | 17.4-r2 (including) | 17.4-r2 (including) |
| Junos | Juniper | 17.4-r2-s1 (including) | 17.4-r2-s1 (including) |
| Junos | Juniper | 17.4-r2-s10 (including) | 17.4-r2-s10 (including) |
| Junos | Juniper | 17.4-r2-s11 (including) | 17.4-r2-s11 (including) |
| Junos | Juniper | 17.4-r2-s12 (including) | 17.4-r2-s12 (including) |
| Junos | Juniper | 17.4-r2-s2 (including) | 17.4-r2-s2 (including) |
| Junos | Juniper | 17.4-r2-s3 (including) | 17.4-r2-s3 (including) |
| Junos | Juniper | 17.4-r2-s4 (including) | 17.4-r2-s4 (including) |
| Junos | Juniper | 17.4-r2-s5 (including) | 17.4-r2-s5 (including) |
| Junos | Juniper | 17.4-r2-s6 (including) | 17.4-r2-s6 (including) |
| Junos | Juniper | 17.4-r2-s7 (including) | 17.4-r2-s7 (including) |
| Junos | Juniper | 17.4-r2-s8 (including) | 17.4-r2-s8 (including) |
| Junos | Juniper | 17.4-r2-s9 (including) | 17.4-r2-s9 (including) |
| Junos | Juniper | 17.4-r3 (including) | 17.4-r3 (including) |
| Junos | Juniper | 17.4-r3-s1 (including) | 17.4-r3-s1 (including) |
| Junos | Juniper | 17.4-r3-s2 (including) | 17.4-r3-s2 (including) |
| Junos | Juniper | 17.4-r3-s3 (including) | 17.4-r3-s3 (including) |
| Junos | Juniper | 17.4-r3-s4 (including) | 17.4-r3-s4 (including) |
| Junos | Juniper | 18.1 (including) | 18.1 (including) |
| Junos | Juniper | 18.1-r1 (including) | 18.1-r1 (including) |
| Junos | Juniper | 18.1-r2 (including) | 18.1-r2 (including) |
| Junos | Juniper | 18.1-r2-s1 (including) | 18.1-r2-s1 (including) |
| Junos | Juniper | 18.1-r2-s2 (including) | 18.1-r2-s2 (including) |
| Junos | Juniper | 18.1-r2-s4 (including) | 18.1-r2-s4 (including) |
| Junos | Juniper | 18.1-r3 (including) | 18.1-r3 (including) |
| Junos | Juniper | 18.1-r3-s1 (including) | 18.1-r3-s1 (including) |
| Junos | Juniper | 18.1-r3-s10 (including) | 18.1-r3-s10 (including) |
| Junos | Juniper | 18.1-r3-s11 (including) | 18.1-r3-s11 (including) |
| Junos | Juniper | 18.1-r3-s12 (including) | 18.1-r3-s12 (including) |
| Junos | Juniper | 18.1-r3-s2 (including) | 18.1-r3-s2 (including) |
| Junos | Juniper | 18.1-r3-s3 (including) | 18.1-r3-s3 (including) |
| Junos | Juniper | 18.1-r3-s4 (including) | 18.1-r3-s4 (including) |
| Junos | Juniper | 18.1-r3-s5 (including) | 18.1-r3-s5 (including) |
| Junos | Juniper | 18.1-r3-s6 (including) | 18.1-r3-s6 (including) |
| Junos | Juniper | 18.1-r3-s7 (including) | 18.1-r3-s7 (including) |
| Junos | Juniper | 18.1-r3-s8 (including) | 18.1-r3-s8 (including) |
| Junos | Juniper | 18.1-r3-s9 (including) | 18.1-r3-s9 (including) |
| Junos | Juniper | 18.2-r2 (including) | 18.2-r2 (including) |
| Junos | Juniper | 18.2-r2-s1 (including) | 18.2-r2-s1 (including) |
| Junos | Juniper | 18.2-r2-s2 (including) | 18.2-r2-s2 (including) |
| Junos | Juniper | 18.2-r2-s3 (including) | 18.2-r2-s3 (including) |
| Junos | Juniper | 18.2-r2-s4 (including) | 18.2-r2-s4 (including) |
| Junos | Juniper | 18.2-r2-s5 (including) | 18.2-r2-s5 (including) |
| Junos | Juniper | 18.2-r2-s6 (including) | 18.2-r2-s6 (including) |
| Junos | Juniper | 18.2-r2-s7 (including) | 18.2-r2-s7 (including) |
| Junos | Juniper | 18.2-r3 (including) | 18.2-r3 (including) |
| Junos | Juniper | 18.2-r3-s1 (including) | 18.2-r3-s1 (including) |
| Junos | Juniper | 18.2-r3-s2 (including) | 18.2-r3-s2 (including) |
| Junos | Juniper | 18.2-r3-s3 (including) | 18.2-r3-s3 (including) |
| Junos | Juniper | 18.2-r3-s4 (including) | 18.2-r3-s4 (including) |
| Junos | Juniper | 18.2-r3-s5 (including) | 18.2-r3-s5 (including) |
| Junos | Juniper | 18.2-r3-s6 (including) | 18.2-r3-s6 (including) |
| Junos | Juniper | 18.2-r3-s7 (including) | 18.2-r3-s7 (including) |
| Junos | Juniper | 18.3 (including) | 18.3 (including) |
| Junos | Juniper | 18.3-r1 (including) | 18.3-r1 (including) |
| Junos | Juniper | 18.3-r1-s1 (including) | 18.3-r1-s1 (including) |
| Junos | Juniper | 18.3-r1-s2 (including) | 18.3-r1-s2 (including) |
| Junos | Juniper | 18.3-r1-s3 (including) | 18.3-r1-s3 (including) |
| Junos | Juniper | 18.3-r1-s4 (including) | 18.3-r1-s4 (including) |
| Junos | Juniper | 18.3-r1-s5 (including) | 18.3-r1-s5 (including) |
| Junos | Juniper | 18.3-r1-s6 (including) | 18.3-r1-s6 (including) |
| Junos | Juniper | 18.3-r2 (including) | 18.3-r2 (including) |
| Junos | Juniper | 18.3-r2-s1 (including) | 18.3-r2-s1 (including) |
| Junos | Juniper | 18.3-r2-s2 (including) | 18.3-r2-s2 (including) |
| Junos | Juniper | 18.3-r2-s3 (including) | 18.3-r2-s3 (including) |
| Junos | Juniper | 18.3-r2-s4 (including) | 18.3-r2-s4 (including) |
| Junos | Juniper | 18.3-r3 (including) | 18.3-r3 (including) |
| Junos | Juniper | 18.3-r3-s1 (including) | 18.3-r3-s1 (including) |
| Junos | Juniper | 18.3-r3-s2 (including) | 18.3-r3-s2 (including) |
| Junos | Juniper | 18.3-r3-s3 (including) | 18.3-r3-s3 (including) |
| Junos | Juniper | 18.3-r3-s4 (including) | 18.3-r3-s4 (including) |
| Junos | Juniper | 18.4 (including) | 18.4 (including) |
| Junos | Juniper | 18.4-r1 (including) | 18.4-r1 (including) |
| Junos | Juniper | 18.4-r1-s1 (including) | 18.4-r1-s1 (including) |
| Junos | Juniper | 18.4-r1-s2 (including) | 18.4-r1-s2 (including) |
| Junos | Juniper | 18.4-r1-s3 (including) | 18.4-r1-s3 (including) |
| Junos | Juniper | 18.4-r1-s4 (including) | 18.4-r1-s4 (including) |
| Junos | Juniper | 18.4-r1-s5 (including) | 18.4-r1-s5 (including) |
| Junos | Juniper | 18.4-r1-s6 (including) | 18.4-r1-s6 (including) |
| Junos | Juniper | 18.4-r1-s7 (including) | 18.4-r1-s7 (including) |
| Junos | Juniper | 18.4-r2 (including) | 18.4-r2 (including) |
| Junos | Juniper | 18.4-r2-s1 (including) | 18.4-r2-s1 (including) |
| Junos | Juniper | 18.4-r2-s2 (including) | 18.4-r2-s2 (including) |
| Junos | Juniper | 18.4-r2-s3 (including) | 18.4-r2-s3 (including) |
| Junos | Juniper | 18.4-r2-s4 (including) | 18.4-r2-s4 (including) |
| Junos | Juniper | 18.4-r2-s5 (including) | 18.4-r2-s5 (including) |
| Junos | Juniper | 18.4-r2-s6 (including) | 18.4-r2-s6 (including) |
| Junos | Juniper | 18.4-r2-s7 (including) | 18.4-r2-s7 (including) |
| Junos | Juniper | 18.4-r2-s8 (including) | 18.4-r2-s8 (including) |
| Junos | Juniper | 18.4-r3 (including) | 18.4-r3 (including) |
| Junos | Juniper | 18.4-r3-s1 (including) | 18.4-r3-s1 (including) |
| Junos | Juniper | 18.4-r3-s2 (including) | 18.4-r3-s2 (including) |
| Junos | Juniper | 18.4-r3-s3 (including) | 18.4-r3-s3 (including) |
| Junos | Juniper | 18.4-r3-s4 (including) | 18.4-r3-s4 (including) |
| Junos | Juniper | 18.4-r3-s5 (including) | 18.4-r3-s5 (including) |
| Junos | Juniper | 18.4-r3-s6 (including) | 18.4-r3-s6 (including) |
| Junos | Juniper | 18.4-r3-s7 (including) | 18.4-r3-s7 (including) |
| Junos | Juniper | 19.1 (including) | 19.1 (including) |
| Junos | Juniper | 19.1-r1 (including) | 19.1-r1 (including) |
| Junos | Juniper | 19.1-r1-s1 (including) | 19.1-r1-s1 (including) |
| Junos | Juniper | 19.1-r1-s2 (including) | 19.1-r1-s2 (including) |
| Junos | Juniper | 19.1-r1-s3 (including) | 19.1-r1-s3 (including) |
| Junos | Juniper | 19.1-r1-s4 (including) | 19.1-r1-s4 (including) |
| Junos | Juniper | 19.1-r1-s5 (including) | 19.1-r1-s5 (including) |
| Junos | Juniper | 19.1-r1-s6 (including) | 19.1-r1-s6 (including) |
| Junos | Juniper | 19.1-r2 (including) | 19.1-r2 (including) |
| Junos | Juniper | 19.1-r2-s1 (including) | 19.1-r2-s1 (including) |
| Junos | Juniper | 19.1-r2-s2 (including) | 19.1-r2-s2 (including) |
| Junos | Juniper | 19.1-r3 (including) | 19.1-r3 (including) |
| Junos | Juniper | 19.1-r3-s1 (including) | 19.1-r3-s1 (including) |
| Junos | Juniper | 19.1-r3-s2 (including) | 19.1-r3-s2 (including) |
| Junos | Juniper | 19.1-r3-s3 (including) | 19.1-r3-s3 (including) |
| Junos | Juniper | 19.1-r3-s4 (including) | 19.1-r3-s4 (including) |
| Junos | Juniper | 19.2 (including) | 19.2 (including) |
| Junos | Juniper | 19.2-r1 (including) | 19.2-r1 (including) |
| Junos | Juniper | 19.2-r1-s1 (including) | 19.2-r1-s1 (including) |
| Junos | Juniper | 19.2-r1-s2 (including) | 19.2-r1-s2 (including) |
| Junos | Juniper | 19.2-r1-s3 (including) | 19.2-r1-s3 (including) |
| Junos | Juniper | 19.2-r1-s4 (including) | 19.2-r1-s4 (including) |
| Junos | Juniper | 19.2-r1-s5 (including) | 19.2-r1-s5 (including) |
| Junos | Juniper | 19.2-r1-s6 (including) | 19.2-r1-s6 (including) |
| Junos | Juniper | 19.2-r2 (including) | 19.2-r2 (including) |
| Junos | Juniper | 19.2-r2-s1 (including) | 19.2-r2-s1 (including) |
| Junos | Juniper | 19.2-r3 (including) | 19.2-r3 (including) |
| Junos | Juniper | 19.2-r3-s1 (including) | 19.2-r3-s1 (including) |
| Junos | Juniper | 19.3 (including) | 19.3 (including) |
| Junos | Juniper | 19.3-r1 (including) | 19.3-r1 (including) |
| Junos | Juniper | 19.3-r1-s1 (including) | 19.3-r1-s1 (including) |
| Junos | Juniper | 19.3-r2 (including) | 19.3-r2 (including) |
| Junos | Juniper | 19.3-r2-s1 (including) | 19.3-r2-s1 (including) |
| Junos | Juniper | 19.3-r2-s2 (including) | 19.3-r2-s2 (including) |
| Junos | Juniper | 19.3-r2-s3 (including) | 19.3-r2-s3 (including) |
| Junos | Juniper | 19.3-r2-s4 (including) | 19.3-r2-s4 (including) |
| Junos | Juniper | 19.3-r2-s5 (including) | 19.3-r2-s5 (including) |
| Junos | Juniper | 19.3-r3 (including) | 19.3-r3 (including) |
| Junos | Juniper | 19.3-r3-s1 (including) | 19.3-r3-s1 (including) |
| Junos | Juniper | 19.4-r1 (including) | 19.4-r1 (including) |
| Junos | Juniper | 19.4-r1-s1 (including) | 19.4-r1-s1 (including) |
| Junos | Juniper | 19.4-r1-s2 (including) | 19.4-r1-s2 (including) |
| Junos | Juniper | 19.4-r1-s3 (including) | 19.4-r1-s3 (including) |
| Junos | Juniper | 19.4-r2 (including) | 19.4-r2 (including) |
| Junos | Juniper | 19.4-r2-s1 (including) | 19.4-r2-s1 (including) |
| Junos | Juniper | 19.4-r2-s2 (including) | 19.4-r2-s2 (including) |
| Junos | Juniper | 19.4-r2-s3 (including) | 19.4-r2-s3 (including) |
| Junos | Juniper | 19.4-r3 (including) | 19.4-r3 (including) |
| Junos | Juniper | 19.4-r3-s1 (including) | 19.4-r3-s1 (including) |
| Junos | Juniper | 19.4-r3-s2 (including) | 19.4-r3-s2 (including) |
| Junos | Juniper | 20.1-r1 (including) | 20.1-r1 (including) |
| Junos | Juniper | 20.1-r1-s1 (including) | 20.1-r1-s1 (including) |
| Junos | Juniper | 20.1-r1-s2 (including) | 20.1-r1-s2 (including) |
| Junos | Juniper | 20.1-r1-s3 (including) | 20.1-r1-s3 (including) |
| Junos | Juniper | 20.1-r1-s4 (including) | 20.1-r1-s4 (including) |
| Junos | Juniper | 20.1-r2 (including) | 20.1-r2 (including) |
| Junos | Juniper | 20.1-r2-s1 (including) | 20.1-r2-s1 (including) |
| Junos | Juniper | 20.2-r1 (including) | 20.2-r1 (including) |
| Junos | Juniper | 20.2-r1-s1 (including) | 20.2-r1-s1 (including) |
| Junos | Juniper | 20.2-r1-s2 (including) | 20.2-r1-s2 (including) |
| Junos | Juniper | 20.2-r1-s3 (including) | 20.2-r1-s3 (including) |
| Junos | Juniper | 20.2-r2 (including) | 20.2-r2 (including) |
| Junos | Juniper | 20.2-r2-s1 (including) | 20.2-r2-s1 (including) |
| Junos | Juniper | 20.2-r2-s2 (including) | 20.2-r2-s2 (including) |
| Junos | Juniper | 20.2-r2-s3 (including) | 20.2-r2-s3 (including) |
| Junos | Juniper | 20.3-r1 (including) | 20.3-r1 (including) |
| Junos | Juniper | 20.3-r1-s1 (including) | 20.3-r1-s1 (including) |
| Junos | Juniper | 20.3-r2 (including) | 20.3-r2 (including) |
| Junos | Juniper | 20.3-r2-s1 (including) | 20.3-r2-s1 (including) |
| Junos | Juniper | 20.4-r1 (including) | 20.4-r1 (including) |
| Junos | Juniper | 20.4-r1-s1 (including) | 20.4-r1-s1 (including) |
Extended Description
This Pillar covers several possibilities:
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/10.html
- https://cwe.mitre.org/data/definitions/120.html
- https://cwe.mitre.org/data/definitions/14.html
- https://cwe.mitre.org/data/definitions/15.html
- https://cwe.mitre.org/data/definitions/182.html
- https://cwe.mitre.org/data/definitions/24.html
- https://cwe.mitre.org/data/definitions/267.html
- https://cwe.mitre.org/data/definitions/3.html
- https://cwe.mitre.org/data/definitions/41.html
- https://cwe.mitre.org/data/definitions/43.html
- https://cwe.mitre.org/data/definitions/44.html
- https://cwe.mitre.org/data/definitions/45.html
- https://cwe.mitre.org/data/definitions/46.html
- https://cwe.mitre.org/data/definitions/47.html
- https://cwe.mitre.org/data/definitions/52.html
- https://cwe.mitre.org/data/definitions/53.html
- https://cwe.mitre.org/data/definitions/6.html
- https://cwe.mitre.org/data/definitions/64.html
- https://cwe.mitre.org/data/definitions/67.html
- https://cwe.mitre.org/data/definitions/7.html
- https://cwe.mitre.org/data/definitions/71.html
- https://cwe.mitre.org/data/definitions/73.html
- https://cwe.mitre.org/data/definitions/78.html
- https://cwe.mitre.org/data/definitions/79.html
- https://cwe.mitre.org/data/definitions/8.html
- https://cwe.mitre.org/data/definitions/80.html
- https://cwe.mitre.org/data/definitions/88.html
- https://cwe.mitre.org/data/definitions/9.html
- https://cwe.mitre.org/data/definitions/92.html