title: Junos OS Evolved: Specific TCP traffic causes OFP core and restart of RE
description:
An Improper Handling of Syntactically Invalid Structure vulnerability in Object Flooding Protocol (OFP) service of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).
On all Junos OS Evolved platforms, when specific TCP packets are received on an open OFP port, the OFP crashes leading to a restart of Routine Engine (RE). Continuous receipt of these specific TCP packets will lead to a sustained Denial of Service (DoS) condition.
This issue affects:
Juniper Networks Junos OS Evolved
*  All versions earlier than 21.2R3-S7-EVO;
*  21.3 versions earlier than 21.3R3-S5-EVO ;
*  21.4 versions earlier than 21.4R3-S5-EVO;
*  22.1 versions earlier than 22.1R3-S4-EVO;
*  22.2 versions earlier than 22.2R3-S3-EVO ;
*  22.3 versions earlier than 22.3R3-EVO;
*  22.4 versions earlier than 22.4R2-EVO, 22.4R3-EVO.
problem types: CWE-228: Improper Handling of Syntactically Invalid Structure
affected:
{
defaultStatus: unaffected
product: Junos OS Evolved
vendor: Juniper Networks
versions:
lessThan: 21.2R3-S7-EVO, status: affected, version: 0, versionType: semver
lessThan: 21.3R3-S5-EVO , status: affected, version: 21.3, versionType: semver
lessThan: 21.4R3-S5-EVO, status: affected, version: 21.4, versionType: semver
lessThan: 22.1R3-S4-EVO, status: affected, version: 22.1, versionType: semver
lessThan: 22.2R3-S3-EVO , status: affected, version: 22.2, versionType: semver
lessThan: 22.3R3-EVO, status: affected, version: 22.3, versionType: semver
lessThan: 22.4R2-EVO, 22.4R3-EVO, status: affected, version: 22.4, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
exploits: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: The following software releases have been updated to resolve this specific issue:
Junos OS Evolved: 21.2R3-S7-EVO, 21.3R3-S5-EVO, 21.4R3-S5-EVO, 22.1R3-S4-EVO, 22.2R3-S3-EVO, 22.3R3-EVO, 22.4R2-EVO, 22.4R3-EVO, 23.2R1-EVO, and all subsequent releases.
workarounds:
In order to prevent this issue, following firewall filter needs to be added for each OFP port.
[ firewall family inet filter mgmt-filter term discard_ofp from protocol tcp ]
[ firewall family inet filter mgmt-filter term discard_ofp from destination-port <ofp_port_1> ]
[ firewall family inet filter mgmt-filter term discard_ofp from destination-port <ofp_port_2> ]
[ firewall family inet filter mgmt-filter term discard_ofp then discard ]
[ firewall family inet filter mgmt-filter term 2 then accept ]
[ interfaces re0:mgmt-0 unit 0 family inet filter input mgmt-filter ]
[ interfaces re1:mgmt-0 unit 0 family inet filter input mgmt-filter ]