title: QFX5000 Series, EX4300, EX4600: A stack buffer overflow vulnerability in Packet Forwarding Engine manager (FXPC) process
description: A certain sequence of valid BGP or IPv6 BFD packets may trigger a stack based buffer overflow in the Junos OS Packet Forwarding Engine manager (FXPC) process on QFX5000 series, EX4300, EX4600 devices. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code execution. Affected releases are Juniper Networks Junos OS on QFX 5000 series, EX4300, EX4600 are: 14.1X53; 15.1X53 versions prior to 15.1X53-D235; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3-S2, 17.3R4; 17.4 versions prior to 17.4R2-S1, 17.4R3; 18.1 versions prior to 18.1R3-S1, 18.1R4; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R2.
problem types: CWE-121 Stack based buffer overflow vulnerability
affected:
{
platforms: QFX5000 series, EX4300, EX4600
product: Junos OS
vendor: Juniper Networks
versions:
status: affected, version: 14.1X53
lessThan: 15.1X53-D235, status: affected, version: 15.1X53, versionType: custom
lessThan: 17.1R3, status: affected, version: 17.1, versionType: custom
lessThan: 18.1R3-S1, 18.1R4, status: affected, version: 18.1, versionType: custom
lessThan: 18.2R2, status: affected, version: 18.2, versionType: custom
lessThan: 18.3R2, status: affected, version: 18.3, versionType: custom
}
{
platforms: QFX5000 series,  EX4300, EX4600
product: Junos OS
vendor: Juniper Networks
versions:
lessThan: 17.2R3, status: affected, version: 17.2, versionType: custom
lessThan: 17.3R3-S2, 17.3R4, status: affected, version: 17.3, versionType: custom
lessThan: 17.4R2-S1, 17.4R3, status: affected, version: 17.4, versionType: custom
}
{
product: Junos OS
vendor: Juniper Networks
versions:
lessThan: 18.2X75-D30, status: affected, version: 18.2X75, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.0
]
exploits: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: The following software releases have been updated to resolve this specific issue: 15.1X53-D235, 17.1R3, 17.2R3, 17.3R3-S2, 17.3R4, 17.4R2-S1, 17.4R3, 18.1R3-S1, 18.1R4, 18.2R2, 18.2X75-D30, 18.3R2, 18.4R1, and all subsequent releases.
workarounds: There are no viable workarounds for this issue.