CVE-2014-6380 in Junos
Summary
by MITRE
Juniper Junos 11.4 before R11, 12.1 before R9, 12.1X44 before D30, 12.1X45 before D20, 12.1X46 before D15, 12.1X47 before D10, 12.2 before R8, 12.2X50 before D70, 12.3 before R6, 13.1 before R4, 13.1X49 before D55, 13.1X50 before D30, 13.2 before R4, 13.2X50 before D20, 13.2X51 before D15, 13.2X52 before D15, 13.3 before R1, when using an em interface to connect to a certain internal network, allows remote attackers to cause a denial of service (em driver bock and FPC reset or "go offline") via a series of crafted (1) CLNP fragmented packets, when clns-routing or ESIS is configured, or (2) IPv4 or (3) IPv6 fragmented packets.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 02/21/2022
This vulnerability affects Juniper Junos operating system versions prior to specific release points, creating a denial of service condition through crafted network packets targeting em interface connections. The flaw manifests when the system processes CLNP fragmented packets under clns-routing or ESIS configuration, or when handling IPv4 and IPv6 fragmented packets. The technical implementation involves the em driver becoming blocked while the Flexible PIC Concentrator (FPC) resets or goes offline, effectively disrupting network connectivity and system availability. This represents a critical weakness in the network infrastructure handling of fragmented packet processing within the routing stack.
The underlying technical mechanism exploits the way the em interface driver manages fragmented packets in specific routing configurations. When CLNP packets are processed under clns-routing or ESIS protocols, or when IPv4/IPv6 fragmented packets are received, the em driver enters a blocked state that triggers the FPC to reset or go offline. This creates a cascading failure where the network device becomes unresponsive to legitimate traffic, effectively causing a denial of service attack that can be executed remotely without authentication. The vulnerability demonstrates poor input validation and resource management in the packet processing pipeline, allowing crafted malformed packets to trigger system-level failures.
The operational impact of this vulnerability extends beyond simple service disruption to potentially compromise network infrastructure reliability and availability. Network administrators face the risk of unauthorized remote attackers causing system outages that can affect critical network services, especially in environments where Juniper devices serve as core routing infrastructure. The attack can be particularly damaging in high-availability networks where such failures could trigger automatic failover mechanisms or cause extended downtime during recovery processes. This vulnerability also creates opportunities for attackers to perform reconnaissance and potentially escalate their attacks through network disruption.
Mitigation strategies should focus on immediate software updates to patched Junos versions, while implementing network segmentation and access controls to limit exposure. Organizations should consider disabling unnecessary routing protocols such as clns-routing and ESIS when not required, and implement proper packet filtering rules to prevent malformed fragmented packets from reaching vulnerable systems. Network monitoring should be enhanced to detect unusual patterns of packet fragmentation that could indicate exploitation attempts. The vulnerability aligns with CWE-129 and CWE-131 categories related to input validation and buffer overflow conditions, while mapping to ATT&CK techniques involving denial of service and network disruption. Regular security assessments and vulnerability management programs should prioritize patching this class of issues to maintain network resilience against similar threats.