title: Junos OS and Junos OS Evolved: OSPFv3 session might go into INIT state upon receipt of multiple crafted packets from a trusted neighbor device.
description: An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who sends specific packets in certain orders and at specific timings to force OSPFv3 to unexpectedly enter graceful-restart (GR helper mode) even though there is not any Grace-LSA received in OSPFv3 causing a Denial of Service (DoS). Unexpectedly entering GR helper mode might cause the OSPFv3 neighbor adjacency formed on this interface to be stuck in the "INIT" state which can be observed by issuing the following command: user@device> show ospf3 neighbor ID Interface State xx.xx.xx.xx ae100.0 Init <<<<<<<<<< An indicator of compromise can be seen in log files when traceoptions for OSPFv3 are enabled before the issue occurs. These logfile messages are as follows: OSPF restart signaling: Received hello with LR bit set from nbr ip=xx::xx id=xx.xx.xx.xx. Set oob-resync capabilty 1. OSPF Restart Signaling: Start helper mode for nbr ip xx::xx id xx.xx.xx.xx OSPF restart signaling: abort helper mode for nbr ip=xx::xx id=xx.xx.xx.xx OSPF neighbor xx::xx (realm ipv6-unicast <interface.unit> area xx.xx.xx.xx) state changed from Full to Init due to 1WayRcvd (event reason: neighbor is in one-way mode) (nbr helped: 0) This issue affects: Juniper Networks Junos OS. 15.1 versions prior to 15.1R7-S11; 18.3 versions prior to 18.3R3-S6; 18.4 versions prior to 18.4R2-S9, 18.4R3-S10; 19.1 versions prior to 19.1R2-S3, 19.1R3-S7; 19.2 versions prior to 19.2R1-S7, 19.2R3-S4; 19.3 versions prior to 19.3R2-S7, 19.3R3-S4; 19.4 versions prior to 19.4R3-S6; 20.1 versions prior to 20.1R3-S1; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R2-S2, 20.4R3; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R1-S1, 21.2R2. This issue does not affect any version of Juniper Networks Junos OS 12.3. This issue affects Juniper Networks Junos OS Evolved all versions prior to 21.2R2-EVO.
problem types: Denial of Service (DoS)
affected:
{
product: Junos OS
vendor: Juniper Networks
versions:
status: unaffected, version: 12.3 Any
lessThan: 15.1R7-S11, status: affected, version: 15.1, versionType: custom
lessThan: 18.3R3-S6, status: affected, version: 18.3, versionType: custom
lessThan: 18.4R2-S9, 18.4R3-S10, status: affected, version: 18.4, versionType: custom
lessThan: 19.1R2-S3, 19.1R3-S7, status: affected, version: 19.1, versionType: custom
lessThan: 19.2R1-S7, 19.2R3-S4, status: affected, version: 19.2, versionType: custom
lessThan: 19.3R2-S7, 19.3R3-S4, status: affected, version: 19.3, versionType: custom
lessThan: 19.4R3-S6, status: affected, version: 19.4, versionType: custom
lessThan: 20.1R3-S1, status: affected, version: 20.1, versionType: custom
lessThan: 20.2R3-S3, status: affected, version: 20.2, versionType: custom
lessThan: 20.3R3-S1, status: affected, version: 20.3, versionType: custom
lessThan: 20.4R2-S2, 20.4R3, status: affected, version: 20.4, versionType: custom
lessThan: 21.1R3, status: affected, version: 21.1, versionType: custom
lessThan: 21.2R1-S1, 21.2R2, status: affected, version: 21.2, versionType: custom
}
{
product: Junos OS Evolved
vendor: Juniper Networks
versions:
lessThan: 21.2R2-EVO, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
exploits: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: The following software releases have been updated to resolve this specific issue:
Junos OS: 15.1R7-S11, 18.3R3-S6, 18.4R2-S9, 18.4R3-S10, 19.1R2-S3, 19.1R3-S7, 19.2R1-S7, 19.2R3-S4, 19.3R2-S7, 19.3R3-S4, 19.4R3-S6, 20.1R3-S1, 20.2R3-S3, 20.3R3-S1, 20.4R2-S2, 20.4R3, 21.1R3, 21.2R1-S1, 21.2R2, 21.3R1, and all subsequent releases.
Junos OS Evolved: 21.2R2-EVO, 21.3R1-EVO, and all subsequent releases.
workarounds: To work around this issue, disable the OSPF GR helper mode for OSPFv3:
[protocols ospf3 graceful-restart helper-disable]
There are no other workarounds for this issue.