title: Junos OS and Junos OS Evolved: A vulnerability in JDHCPD allows an attacker to send crafted IPv6 packets and arbitrarily execute commands on the target device.
description: When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon (JDHCPD) process on Junos OS or Junos OS Evolved which is configured in relay mode it vulnerable to an attacker sending crafted IPv6 packets who may then arbitrarily execute commands as root on the target device. This issue affects IPv6 JDHCPD services. This issue affects: Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S6; 15.1X49 versions prior to 15.1X49-D200; 15.1X53 versions prior to 15.1X53-D592; 16.1 versions prior to 16.1R7-S6; 16.2 versions prior to 16.2R2-S11; 17.1 versions prior to 17.1R2-S11, 17.1R3-S1; 17.2 versions prior to 17.2R2-S8, 17.2R3-S3; 17.3 versions prior to 17.3R3-S6; 17.4 versions prior to 17.4R2-S7, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3-S2; 18.2X75 versions prior to 18.2X75-D60; 18.3 versions prior to 18.3R1-S6, 18.3R2-S2, 18.3R3; 18.4 versions prior to 18.4R1-S5, 18.4R2-S3, 18.4R3; 19.1 versions prior to 19.1R1-S3, 19.1R2; 19.2 versions prior to 19.2R1-S3, 19.2R2*. and All versions prior to 19.3R1 on Junos OS Evolved. This issue do not affect versions of Junos OS prior to 15.1, or JDHCPD operating as a local server in non-relay mode.
problem types: CWE-121 Stack-based Buffer Overflow
affected:
{
product: Junos OS
vendor: Juniper Networks
versions:
lessThan: 15.1R7-S6, status: affected, version: 15.1, versionType: custom
lessThan: 15.1X49-D200, status: affected, version: 15.1X49, versionType: custom
lessThan: 15.1X53-D592, status: affected, version: 15.1X53, versionType: custom
lessThan: 16.1R7-S6, status: affected, version: 16.1, versionType: custom
lessThan: 16.2R2-S11, status: affected, version: 16.2, versionType: custom
lessThan: 17.1R2-S11, 17.1R3-S1, status: affected, version: 17.1, versionType: custom
lessThan: 17.2R2-S8, 17.2R3-S3, status: affected, version: 17.2, versionType: custom
lessThan: 17.3R3-S6, status: affected, version: 17.3, versionType: custom
lessThan: 17.4R2-S7, 17.4R3, status: affected, version: 17.4, versionType: custom
lessThan: 18.1R3-S8, status: affected, version: 18.1, versionType: custom
lessThan: 18.2R3-S2, status: affected, version: 18.2, versionType: custom
lessThan: 18.3R1-S6, 18.3R2-S2, 18.3R3, status: affected, version: 18.3, versionType: custom
lessThan: 18.4R1-S5, 18.4R2-S3, 18.4R3, status: affected, version: 18.4, versionType: custom
lessThan: 19.1R1-S3, 19.1R2, status: affected, version: 19.1, versionType: custom
lessThan: 19.2R1-S3, 19.2R2, status: affected, version: 19.2, versionType: custom
lessThan: 19.3R1, 19.3R2, status: affected, version: 19.3, versionType: custom
lessThan: 18.2X75-D60, status: affected, version: 18.2X75, versionType: custom
}
{
platforms: Junos Evolved
product: Junos OS Evolved
vendor: Juniper Networks
versions:
lessThan: 19.3R1, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
exploits: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: The following software releases have been updated to resolve this specific issue:
Junos OS: 15.1R7-S6, 15.1X49-D200, 15.1X53-D592, 16.1R7-S6, 16.2R2-S11, 17.1R2-S11, 17.1R3-S1, 17.2R2-S8, 17.2R3-S3, 17.3R3-S6, 17.4R2-S7, 17.4R3, 18.1R3-S8, 18.2R3-S2, 18.2X75-D60, 18.3R1-S6, 18.3R2-S2, 18.3R3, 18.4R1-S5,  18.4R2-S3, 18.4R3, 19.1R1-S3, 19.1R2, 19.2R1-S3, 19.2R2*, 19.3R1, and all subsequent releases.
Junos OS Evolved: 19.3R1, and all subsequent releases.
*pending publication
workarounds: If JDHCPD is not needed then disable the service in the device configuration.
There are no other viable workarounds for this issue.