Juniper Junos OS/Junos OS Evolved RPD Undefined undefined values

Summaryinfo

A vulnerability, which was classified as problematic, was found in Juniper Junos OS and Junos OS Evolved. Affected by this issue is some unknown functionality of the component RPD. The manipulation of the argument Undefined results in improper handling of undefined values. This vulnerability is reported as CVE-2022-22213. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Juniper Junos OS and Junos OS Evolved (Router Operating System) (affected version not known). It has been classified as problematic. Affected is some unknown functionality of the component RPD. The manipulation of the argument Undefined with an unknown input leads to a improper handling of undefined values vulnerability. CWE is classifying the issue as CWE-232. The product does not handle or incorrectly handles when a value is not defined or supported for the associated parameter, field, or argument name. This is going to have an impact on availability. CVE summarizes:

A vulnerability in Handling of Undefined Values in the routing protocol daemon (RPD) process of Juniper Networks Junos OS and Junos OS Evolved may allow an unauthenticated network-based attacker to crash the RPD process by sending a specific BGP update while the system is under heavy load, leading to a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. Malicious exploitation of this issue requires a very specific combination of load, timing, and configuration of the vulnerable system which is beyond the direct control of the attacker. Internal reproduction has only been possible through artificially created load and specially instrumented source code. Systems are only vulnerable to this issue if BGP multipath is enabled. Routers not configured for BGP multipath are not vulnerable to this issue. This issue affects: Juniper Networks Junos OS: 21.1 versions prior to 21.1R3-S1; 21.2 versions prior to 21.2R2-S2, 21.2R3; 21.3 versions prior to 21.3R2, 21.3R3; 21.4 versions prior to 21.4R1-S1, 21.4R2. Juniper Networks Junos OS Evolved: 21.1 versions prior to 21.1R3-S1-EVO; 21.2 version 21.2R1-EVO and later versions; 21.3 versions prior to 21.3R3-EVO; 21.4 versions prior to 21.4R1-S1-EVO, 21.4R2-EVO. This issue does not affect: Juniper Networks Junos OS versions prior to 21.1. Juniper Networks Junos OS Evolved versions prior to 21.1-EVO.

The weakness was disclosed 07/20/2022 as JSA69717. The advisory is shared for download at kb.juniper.net. This vulnerability is traded as CVE-2022-22213 since 12/21/2021. There are known technical details, but no exploit is available.

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS
• Junos OS Evolved

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion