CVE Vulnerabilities

CVE-2024-21616

Published: Jan 12, 2024 | Modified: Jan 19, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

An Improper Validation of Syntactic Correctness of Input vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause Denial of Service (DoS).

On all Junos OS MX Series and SRX Series platforms, when SIP ALG is enabled, and a specific SIP packet is received and processed, NAT IP allocation fails for genuine traffic, which causes Denial of Service (DoS). Continuous receipt of this specific SIP ALG packet will cause a sustained DoS condition.

NAT IP usage can be monitored by running the following command.

user@srx> show security nat resource-usage source-pool <source_pool_name>

Pool name: source_pool_name .. Address Factor-index Port-range Used Avail Total Usage X.X.X.X 0 Single Ports 50258 52342 62464 96% ««<

  • Alg Ports 0 2048 2048 0% This issue affects:

Juniper Networks Junos OS on MX Series and SRX Series

  • All versions earlier than 21.2R3-S6;
  • 21.3 versions earlier than 21.3R3-S5;
  • 21.4 versions earlier than 21.4R3-S5;
  • 22.1 versions earlier than 22.1R3-S4;
  • 22.2 versions earlier than 22.2R3-S3;
  • 22.3 versions earlier than 22.3R3-S1;
  • 22.4 versions earlier than 22.4R2-S2, 22.4R3;
  • 23.2 versions earlier than 23.2R1-S1, 23.2R2.

Affected Software

Name Vendor Start Version End Version
Junos Juniper 21.2 21.2
Junos Juniper 21.2 21.2
Junos Juniper 21.2 21.2
Junos Juniper 21.2 21.2
Junos Juniper 21.2 21.2
Junos Juniper 21.2 21.2
Junos Juniper 21.2 21.2
Junos Juniper 21.2 21.2
Junos Juniper 21.2 21.2
Junos Juniper 21.2 21.2
Junos Juniper 21.2 21.2
Junos Juniper 21.2 21.2
Junos Juniper 21.2 21.2

References