An Improper Check for Unusual or Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS Evolved may allow a network-based unauthenticated attacker to crash the device (vmcore) by sending a specific TCP packet over an established TCP session with MD5 authentication enabled, destined to an accessible port on the device, resulting in a Denial of Service (DoS). The receipt of this packet must occur within a specific timing window outside the attackers control (i.e., race condition).
Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.
This issue only affects dual RE systems with Nonstop Active Routing (NSR) enabled. Exploitation can only occur over TCP sessions with MD5 authentication enabled (e.g., BGP with MD5 authentication).
This issue affects Junos OS Evolved:
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Junos_os_evolved | Juniper | * | 21.2 (excluding) |
Junos_os_evolved | Juniper | 21.2 (including) | 21.2 (including) |
Junos_os_evolved | Juniper | 21.2-r1 (including) | 21.2-r1 (including) |
Junos_os_evolved | Juniper | 21.2-r1-s1 (including) | 21.2-r1-s1 (including) |
Junos_os_evolved | Juniper | 21.2-r1-s2 (including) | 21.2-r1-s2 (including) |
Junos_os_evolved | Juniper | 21.2-r2 (including) | 21.2-r2 (including) |
Junos_os_evolved | Juniper | 21.2-r2-s1 (including) | 21.2-r2-s1 (including) |
Junos_os_evolved | Juniper | 21.2-r2-s2 (including) | 21.2-r2-s2 (including) |
Junos_os_evolved | Juniper | 21.2-r3 (including) | 21.2-r3 (including) |
Junos_os_evolved | Juniper | 21.2-r3-s1 (including) | 21.2-r3-s1 (including) |
Junos_os_evolved | Juniper | 21.2-r3-s2 (including) | 21.2-r3-s2 (including) |
Junos_os_evolved | Juniper | 21.2-r3-s3 (including) | 21.2-r3-s3 (including) |
Junos_os_evolved | Juniper | 21.2-r3-s4 (including) | 21.2-r3-s4 (including) |
Junos_os_evolved | Juniper | 21.2-r3-s5 (including) | 21.2-r3-s5 (including) |
Junos_os_evolved | Juniper | 21.2-r3-s6 (including) | 21.2-r3-s6 (including) |
Junos_os_evolved | Juniper | 21.2-r3-s7 (including) | 21.2-r3-s7 (including) |
Junos_os_evolved | Juniper | 21.4 (including) | 21.4 (including) |
Junos_os_evolved | Juniper | 21.4-r1 (including) | 21.4-r1 (including) |
Junos_os_evolved | Juniper | 21.4-r1-s1 (including) | 21.4-r1-s1 (including) |
Junos_os_evolved | Juniper | 21.4-r1-s2 (including) | 21.4-r1-s2 (including) |
Junos_os_evolved | Juniper | 21.4-r2 (including) | 21.4-r2 (including) |
Junos_os_evolved | Juniper | 21.4-r2-s1 (including) | 21.4-r2-s1 (including) |
Junos_os_evolved | Juniper | 21.4-r2-s2 (including) | 21.4-r2-s2 (including) |
Junos_os_evolved | Juniper | 21.4-r3 (including) | 21.4-r3 (including) |
Junos_os_evolved | Juniper | 21.4-r3-s1 (including) | 21.4-r3-s1 (including) |
Junos_os_evolved | Juniper | 21.4-r3-s2 (including) | 21.4-r3-s2 (including) |
Junos_os_evolved | Juniper | 21.4-r3-s3 (including) | 21.4-r3-s3 (including) |
Junos_os_evolved | Juniper | 21.4-r3-s4 (including) | 21.4-r3-s4 (including) |
Junos_os_evolved | Juniper | 21.4-r3-s5 (including) | 21.4-r3-s5 (including) |
Junos_os_evolved | Juniper | 22.1 (including) | 22.1 (including) |
Junos_os_evolved | Juniper | 22.1-r1 (including) | 22.1-r1 (including) |
Junos_os_evolved | Juniper | 22.1-r1-s1 (including) | 22.1-r1-s1 (including) |
Junos_os_evolved | Juniper | 22.1-r1-s2 (including) | 22.1-r1-s2 (including) |
Junos_os_evolved | Juniper | 22.1-r2 (including) | 22.1-r2 (including) |
Junos_os_evolved | Juniper | 22.1-r2-s1 (including) | 22.1-r2-s1 (including) |
Junos_os_evolved | Juniper | 22.1-r3 (including) | 22.1-r3 (including) |
Junos_os_evolved | Juniper | 22.1-r3-s1 (including) | 22.1-r3-s1 (including) |
Junos_os_evolved | Juniper | 22.1-r3-s2 (including) | 22.1-r3-s2 (including) |
Junos_os_evolved | Juniper | 22.1-r3-s3 (including) | 22.1-r3-s3 (including) |
Junos_os_evolved | Juniper | 22.2 (including) | 22.2 (including) |
Junos_os_evolved | Juniper | 22.2-r1 (including) | 22.2-r1 (including) |
Junos_os_evolved | Juniper | 22.2-r1-s1 (including) | 22.2-r1-s1 (including) |
Junos_os_evolved | Juniper | 22.2-r1-s2 (including) | 22.2-r1-s2 (including) |
Junos_os_evolved | Juniper | 22.2-r2 (including) | 22.2-r2 (including) |
Junos_os_evolved | Juniper | 22.2-r2-s1 (including) | 22.2-r2-s1 (including) |
Junos_os_evolved | Juniper | 22.2-r2-s2 (including) | 22.2-r2-s2 (including) |
Junos_os_evolved | Juniper | 22.2-r3 (including) | 22.2-r3 (including) |
Junos_os_evolved | Juniper | 22.2-r3-s1 (including) | 22.2-r3-s1 (including) |
Junos_os_evolved | Juniper | 22.2-r3-s2 (including) | 22.2-r3-s2 (including) |
Junos_os_evolved | Juniper | 22.2-r3-s3 (including) | 22.2-r3-s3 (including) |
Junos_os_evolved | Juniper | 22.3 (including) | 22.3 (including) |
Junos_os_evolved | Juniper | 22.3-r1 (including) | 22.3-r1 (including) |
Junos_os_evolved | Juniper | 22.3-r1-s1 (including) | 22.3-r1-s1 (including) |
Junos_os_evolved | Juniper | 22.3-r1-s2 (including) | 22.3-r1-s2 (including) |
Junos_os_evolved | Juniper | 22.3-r2 (including) | 22.3-r2 (including) |
Junos_os_evolved | Juniper | 22.3-r2-s1 (including) | 22.3-r2-s1 (including) |
Junos_os_evolved | Juniper | 22.3-r2-s2 (including) | 22.3-r2-s2 (including) |
Junos_os_evolved | Juniper | 22.3-r3 (including) | 22.3-r3 (including) |
Junos_os_evolved | Juniper | 22.3-r3-s1 (including) | 22.3-r3-s1 (including) |
Junos_os_evolved | Juniper | 22.3-r3-s2 (including) | 22.3-r3-s2 (including) |
Junos_os_evolved | Juniper | 22.4 (including) | 22.4 (including) |
Junos_os_evolved | Juniper | 22.4-r1 (including) | 22.4-r1 (including) |
Junos_os_evolved | Juniper | 22.4-r1-s1 (including) | 22.4-r1-s1 (including) |
Junos_os_evolved | Juniper | 22.4-r1-s2 (including) | 22.4-r1-s2 (including) |
Junos_os_evolved | Juniper | 22.4-r2 (including) | 22.4-r2 (including) |
Junos_os_evolved | Juniper | 22.4-r2-s1 (including) | 22.4-r2-s1 (including) |
The programmer may assume that certain events or conditions will never occur or do not need to be worried about, such as low memory conditions, lack of access to resources due to restrictive permissions, or misbehaving clients or components. However, attackers may intentionally trigger these unusual conditions, thus violating the programmer’s assumptions, possibly introducing instability, incorrect behavior, or a vulnerability. Note that this entry is not exclusively about the use of exceptions and exception handling, which are mechanisms for both checking and handling unusual or unexpected conditions.