A Reachable Assertion vulnerability in Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a locally-based, low-privileged attacker to cause a Denial of Service (DoS).
On all Junos OS and Junos OS Evolved, when a specific L2VPN command is run, RPD will crash and restart. Continued execution of this specific command will create a sustained Denial of Service (DoS) condition.
This issue affects: Juniper Networks Junos OS All versions prior to 19.3R3-S10; 20.1 versions prior to 20.1R3-S4; 20.2 versions prior to 20.2R3-S6; 20.3 versions prior to 20.3R3-S6; 20.4 versions prior to 20.4R3-S5; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S3; 21.3 versions prior to 21.3R3-S2; 21.4 versions prior to 21.4R3; 22.1 versions prior to 22.1R3; 22.2 versions prior to 22.2R2; 22.3 versions prior to 22.3R2;
Juniper Networks Junos OS Evolved All versions prior to 20.4R3-S7-EVO; 21.1 versions prior to 21.1R3-S3-EVO; 21.2 versions prior to 21.2R3-S5-EVO; 21.3 versions prior to 21.3R3-S4-EVO; 21.4 versions prior to 21.4R3-EVO; 22.1 versions prior to 22.1R3-EVO; 22.2 versions prior to 22.2R2-EVO; 22.3 versions prior to 22.3R2-EVO;
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Junos | Juniper | * | 19.3 (excluding) |
| Junos | Juniper | 19.3 (including) | 19.3 (including) |
| Junos | Juniper | 19.3-r1 (including) | 19.3-r1 (including) |
| Junos | Juniper | 19.3-r1-s1 (including) | 19.3-r1-s1 (including) |
| Junos | Juniper | 19.3-r2 (including) | 19.3-r2 (including) |
| Junos | Juniper | 19.3-r2-s1 (including) | 19.3-r2-s1 (including) |
| Junos | Juniper | 19.3-r2-s2 (including) | 19.3-r2-s2 (including) |
| Junos | Juniper | 19.3-r2-s3 (including) | 19.3-r2-s3 (including) |
| Junos | Juniper | 19.3-r2-s4 (including) | 19.3-r2-s4 (including) |
| Junos | Juniper | 19.3-r2-s5 (including) | 19.3-r2-s5 (including) |
| Junos | Juniper | 19.3-r2-s6 (including) | 19.3-r2-s6 (including) |
| Junos | Juniper | 19.3-r2-s7 (including) | 19.3-r2-s7 (including) |
| Junos | Juniper | 19.3-r3 (including) | 19.3-r3 (including) |
| Junos | Juniper | 19.3-r3-s1 (including) | 19.3-r3-s1 (including) |
| Junos | Juniper | 19.3-r3-s2 (including) | 19.3-r3-s2 (including) |
| Junos | Juniper | 19.3-r3-s3 (including) | 19.3-r3-s3 (including) |
| Junos | Juniper | 19.3-r3-s4 (including) | 19.3-r3-s4 (including) |
| Junos | Juniper | 19.3-r3-s5 (including) | 19.3-r3-s5 (including) |
| Junos | Juniper | 19.3-r3-s6 (including) | 19.3-r3-s6 (including) |
| Junos | Juniper | 19.4 (including) | 19.4 (including) |
| Junos | Juniper | 19.4-r1 (including) | 19.4-r1 (including) |
| Junos | Juniper | 19.4-r1-s1 (including) | 19.4-r1-s1 (including) |
| Junos | Juniper | 19.4-r1-s2 (including) | 19.4-r1-s2 (including) |
| Junos | Juniper | 19.4-r1-s3 (including) | 19.4-r1-s3 (including) |
| Junos | Juniper | 19.4-r1-s4 (including) | 19.4-r1-s4 (including) |
| Junos | Juniper | 19.4-r2 (including) | 19.4-r2 (including) |
| Junos | Juniper | 19.4-r2-s1 (including) | 19.4-r2-s1 (including) |
| Junos | Juniper | 19.4-r2-s2 (including) | 19.4-r2-s2 (including) |
| Junos | Juniper | 19.4-r2-s3 (including) | 19.4-r2-s3 (including) |
| Junos | Juniper | 19.4-r2-s4 (including) | 19.4-r2-s4 (including) |
| Junos | Juniper | 19.4-r2-s5 (including) | 19.4-r2-s5 (including) |
| Junos | Juniper | 19.4-r2-s6 (including) | 19.4-r2-s6 (including) |
| Junos | Juniper | 19.4-r2-s7 (including) | 19.4-r2-s7 (including) |
| Junos | Juniper | 19.4-r3 (including) | 19.4-r3 (including) |
| Junos | Juniper | 19.4-r3-s1 (including) | 19.4-r3-s1 (including) |
| Junos | Juniper | 19.4-r3-s2 (including) | 19.4-r3-s2 (including) |
| Junos | Juniper | 19.4-r3-s3 (including) | 19.4-r3-s3 (including) |
| Junos | Juniper | 19.4-r3-s4 (including) | 19.4-r3-s4 (including) |
| Junos | Juniper | 19.4-r3-s5 (including) | 19.4-r3-s5 (including) |
| Junos | Juniper | 19.4-r3-s6 (including) | 19.4-r3-s6 (including) |
| Junos | Juniper | 19.4-r3-s7 (including) | 19.4-r3-s7 (including) |
| Junos | Juniper | 19.4-r3-s8 (including) | 19.4-r3-s8 (including) |
| Junos | Juniper | 19.4-r3-s9 (including) | 19.4-r3-s9 (including) |
| Junos | Juniper | 20.1 (including) | 20.1 (including) |
| Junos | Juniper | 20.1-r1 (including) | 20.1-r1 (including) |
| Junos | Juniper | 20.1-r1-s1 (including) | 20.1-r1-s1 (including) |
| Junos | Juniper | 20.1-r1-s2 (including) | 20.1-r1-s2 (including) |
| Junos | Juniper | 20.1-r1-s3 (including) | 20.1-r1-s3 (including) |
| Junos | Juniper | 20.1-r1-s4 (including) | 20.1-r1-s4 (including) |
| Junos | Juniper | 20.1-r2 (including) | 20.1-r2 (including) |
| Junos | Juniper | 20.1-r2-s1 (including) | 20.1-r2-s1 (including) |
| Junos | Juniper | 20.1-r2-s2 (including) | 20.1-r2-s2 (including) |
| Junos | Juniper | 20.1-r3 (including) | 20.1-r3 (including) |
| Junos | Juniper | 20.1-r3-s1 (including) | 20.1-r3-s1 (including) |
| Junos | Juniper | 20.1-r3-s2 (including) | 20.1-r3-s2 (including) |
| Junos | Juniper | 20.1-r3-s3 (including) | 20.1-r3-s3 (including) |
| Junos | Juniper | 20.2 (including) | 20.2 (including) |
| Junos | Juniper | 20.2-r1 (including) | 20.2-r1 (including) |
| Junos | Juniper | 20.2-r1-s1 (including) | 20.2-r1-s1 (including) |
| Junos | Juniper | 20.2-r1-s2 (including) | 20.2-r1-s2 (including) |
| Junos | Juniper | 20.2-r1-s3 (including) | 20.2-r1-s3 (including) |
| Junos | Juniper | 20.2-r2 (including) | 20.2-r2 (including) |
| Junos | Juniper | 20.2-r2-s1 (including) | 20.2-r2-s1 (including) |
| Junos | Juniper | 20.2-r2-s2 (including) | 20.2-r2-s2 (including) |
| Junos | Juniper | 20.2-r2-s3 (including) | 20.2-r2-s3 (including) |
| Junos | Juniper | 20.2-r3 (including) | 20.2-r3 (including) |
| Junos | Juniper | 20.2-r3-s1 (including) | 20.2-r3-s1 (including) |
| Junos | Juniper | 20.2-r3-s2 (including) | 20.2-r3-s2 (including) |
| Junos | Juniper | 20.2-r3-s3 (including) | 20.2-r3-s3 (including) |
| Junos | Juniper | 20.2-r3-s4 (including) | 20.2-r3-s4 (including) |
| Junos | Juniper | 20.2-r3-s5 (including) | 20.2-r3-s5 (including) |
| Junos | Juniper | 20.3 (including) | 20.3 (including) |
| Junos | Juniper | 20.3-r1 (including) | 20.3-r1 (including) |
| Junos | Juniper | 20.3-r1-s1 (including) | 20.3-r1-s1 (including) |
| Junos | Juniper | 20.3-r1-s2 (including) | 20.3-r1-s2 (including) |
| Junos | Juniper | 20.3-r2 (including) | 20.3-r2 (including) |
| Junos | Juniper | 20.3-r2-s1 (including) | 20.3-r2-s1 (including) |
| Junos | Juniper | 20.3-r3 (including) | 20.3-r3 (including) |
| Junos | Juniper | 20.3-r3-s1 (including) | 20.3-r3-s1 (including) |
| Junos | Juniper | 20.3-r3-s2 (including) | 20.3-r3-s2 (including) |
| Junos | Juniper | 20.3-r3-s3 (including) | 20.3-r3-s3 (including) |
| Junos | Juniper | 20.3-r3-s4 (including) | 20.3-r3-s4 (including) |
| Junos | Juniper | 20.3-r3-s5 (including) | 20.3-r3-s5 (including) |
| Junos | Juniper | 20.4 (including) | 20.4 (including) |
| Junos | Juniper | 20.4-r1 (including) | 20.4-r1 (including) |
| Junos | Juniper | 20.4-r1-s1 (including) | 20.4-r1-s1 (including) |
| Junos | Juniper | 20.4-r2 (including) | 20.4-r2 (including) |
| Junos | Juniper | 20.4-r2-s1 (including) | 20.4-r2-s1 (including) |
| Junos | Juniper | 20.4-r2-s2 (including) | 20.4-r2-s2 (including) |
| Junos | Juniper | 20.4-r3 (including) | 20.4-r3 (including) |
| Junos | Juniper | 20.4-r3-s1 (including) | 20.4-r3-s1 (including) |
| Junos | Juniper | 20.4-r3-s2 (including) | 20.4-r3-s2 (including) |
| Junos | Juniper | 20.4-r3-s3 (including) | 20.4-r3-s3 (including) |
| Junos | Juniper | 20.4-r3-s4 (including) | 20.4-r3-s4 (including) |
| Junos | Juniper | 21.1 (including) | 21.1 (including) |
| Junos | Juniper | 21.1-r1 (including) | 21.1-r1 (including) |
| Junos | Juniper | 21.1-r1-s1 (including) | 21.1-r1-s1 (including) |
| Junos | Juniper | 21.1-r2 (including) | 21.1-r2 (including) |
| Junos | Juniper | 21.1-r2-s1 (including) | 21.1-r2-s1 (including) |
| Junos | Juniper | 21.1-r2-s2 (including) | 21.1-r2-s2 (including) |
| Junos | Juniper | 21.1-r3 (including) | 21.1-r3 (including) |
| Junos | Juniper | 21.1-r3-s1 (including) | 21.1-r3-s1 (including) |
| Junos | Juniper | 21.1-r3-s2 (including) | 21.1-r3-s2 (including) |
| Junos | Juniper | 21.1-r3-s3 (including) | 21.1-r3-s3 (including) |
| Junos | Juniper | 21.2 (including) | 21.2 (including) |
| Junos | Juniper | 21.2-r1 (including) | 21.2-r1 (including) |
| Junos | Juniper | 21.2-r1-s1 (including) | 21.2-r1-s1 (including) |
| Junos | Juniper | 21.2-r1-s2 (including) | 21.2-r1-s2 (including) |
| Junos | Juniper | 21.2-r2 (including) | 21.2-r2 (including) |
| Junos | Juniper | 21.2-r2-s1 (including) | 21.2-r2-s1 (including) |
| Junos | Juniper | 21.2-r2-s2 (including) | 21.2-r2-s2 (including) |
| Junos | Juniper | 21.2-r3 (including) | 21.2-r3 (including) |
| Junos | Juniper | 21.2-r3-s1 (including) | 21.2-r3-s1 (including) |
| Junos | Juniper | 21.2-r3-s2 (including) | 21.2-r3-s2 (including) |
| Junos | Juniper | 21.3 (including) | 21.3 (including) |
| Junos | Juniper | 21.3-r1 (including) | 21.3-r1 (including) |
| Junos | Juniper | 21.3-r1-s1 (including) | 21.3-r1-s1 (including) |
| Junos | Juniper | 21.3-r1-s2 (including) | 21.3-r1-s2 (including) |
| Junos | Juniper | 21.3-r2 (including) | 21.3-r2 (including) |
| Junos | Juniper | 21.3-r2-s1 (including) | 21.3-r2-s1 (including) |
| Junos | Juniper | 21.3-r2-s2 (including) | 21.3-r2-s2 (including) |
| Junos | Juniper | 21.3-r3 (including) | 21.3-r3 (including) |
| Junos | Juniper | 21.3-r3-s1 (including) | 21.3-r3-s1 (including) |
| Junos | Juniper | 21.4 (including) | 21.4 (including) |
| Junos | Juniper | 21.4-r1 (including) | 21.4-r1 (including) |
| Junos | Juniper | 21.4-r1-s1 (including) | 21.4-r1-s1 (including) |
| Junos | Juniper | 21.4-r1-s2 (including) | 21.4-r1-s2 (including) |
| Junos | Juniper | 21.4-r2 (including) | 21.4-r2 (including) |
| Junos | Juniper | 21.4-r2-s1 (including) | 21.4-r2-s1 (including) |
| Junos | Juniper | 21.4-r2-s2 (including) | 21.4-r2-s2 (including) |
| Junos | Juniper | 22.1-r1 (including) | 22.1-r1 (including) |
| Junos | Juniper | 22.1-r1-s1 (including) | 22.1-r1-s1 (including) |
| Junos | Juniper | 22.1-r1-s2 (including) | 22.1-r1-s2 (including) |
| Junos | Juniper | 22.1-r2 (including) | 22.1-r2 (including) |
| Junos | Juniper | 22.1-r2-s1 (including) | 22.1-r2-s1 (including) |
| Junos | Juniper | 22.1-r2-s2 (including) | 22.1-r2-s2 (including) |
| Junos | Juniper | 22.2-r1 (including) | 22.2-r1 (including) |
| Junos | Juniper | 22.2-r1-s1 (including) | 22.2-r1-s1 (including) |
| Junos | Juniper | 22.2-r1-s2 (including) | 22.2-r1-s2 (including) |
| Junos | Juniper | 22.3-r1 (including) | 22.3-r1 (including) |
| Junos | Juniper | 22.3-r1-s1 (including) | 22.3-r1-s1 (including) |
| Junos | Juniper | 22.3-r1-s2 (including) | 22.3-r1-s2 (including) |
While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service. For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.