CVE-2017-2346 in Junos
Summary
by MITRE
An MS-MPC or MS-MIC Service PIC may crash when large fragmented packets are passed through an Application Layer Gateway (ALG). Repeated crashes of the Service PC can result in an extended denial of service condition. The issue can be seen only if NAT or stateful-firewall rules are configured with ALGs enabled. This issue was caused by the code change for PR 1182910 in Junos OS 14.1X55-D30, 14.1X55-D35, 14.2R7, 15.1R5, and 16.1R2. No other versions of Junos OS and no other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS on MX platforms running: 14.1X55 from 14.1X55-D30 to releases prior to 14.1X55-D35; 14.2R from 14.2R7 to releases prior to 14.2R7-S4, 14.2R8; 15.1R from 15.1R5 to releases prior to 15.1R5-S2, 15.1R6; 16.1R from 16.1R2 to releases prior to 16.1R3-S2, 16.1R4.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 12/12/2022
The vulnerability described in CVE-2017-2346 represents a critical denial of service condition affecting Juniper Networks MX platform routers running specific versions of Junos OS. This issue manifests through the MS-MPC (Multi-Chassis Multi-Protocol Control) and MS-MIC (Multi-Chassis Interface Card) services within the Application Layer Gateway (ALG) functionality, creating a scenario where legitimate network traffic can trigger system instability. The vulnerability specifically targets the handling of large fragmented packets that pass through ALG-enabled NAT or stateful firewall configurations, demonstrating how seemingly routine network operations can escalate into significant operational disruptions.
The technical root cause of this vulnerability stems from a code modification implemented for PR 1182910 within Junos OS versions 14.1X55-D30, 14.1X55-D35, 14.2R7, 15.1R5, and 16.1R2. This change introduced a flaw in how the system processes fragmented packets within the ALG context, particularly affecting the MS-MPC and MS-MIC service components that manage inter-chassis communication and interface processing. The vulnerability occurs when these services encounter large fragmented packets that exceed normal processing thresholds, causing memory management issues and subsequent service crashes. The flaw aligns with CWE-129, which addresses improper validation of length values, and CWE-248, covering exposure of unintended alternate path in a resource. The implementation error creates a condition where the service PIC (Processing Interface Card) becomes unstable when processing these specific packet patterns, leading to cascading failures that can persist until manual intervention occurs.
The operational impact of CVE-2017-2346 extends beyond simple service disruption to create extended denial of service conditions that can severely impact network availability and reliability. When the MS-MPC or MS-MIC services crash repeatedly due to large fragmented packets, the affected router experiences prolonged downtime that can span hours or days, depending on the frequency of affected traffic patterns. Network administrators face significant challenges in identifying and mitigating this issue since the problem only manifests when NAT or stateful firewall rules include ALG configurations, making it difficult to distinguish between legitimate traffic and the triggering condition. The vulnerability affects critical infrastructure components within Juniper MX platforms, potentially disrupting core network services including routing stability, inter-chassis communication, and overall device performance, with implications for network security and operational continuity.
Mitigation strategies for this vulnerability require immediate attention from network administrators and security teams responsible for Juniper MX platform deployments. The primary recommended action involves upgrading affected Junos OS versions to patched releases that contain the corrected code implementation for PR 1182910, specifically targeting the affected release ranges including 14.1X55-D35, 14.2R7-S4, 14.2R8, 15.1R5-S2, 15.1R6, 16.1R3-S2, and 16.1R4. Organizations should also consider temporarily disabling ALG functionality on affected devices when large fragmented packet traffic patterns cannot be immediately mitigated through firmware updates. From an ATT&CK framework perspective, this vulnerability maps to T1499.004, which covers network disruption through resource exhaustion, and T1566.002, involving the exploitation of network infrastructure for denial of service attacks. Network defenders should implement monitoring solutions to detect unusual service crash patterns and establish incident response procedures to address potential exploitation of this vulnerability through crafted fragmented packet attacks that leverage the ALG processing functionality.