Juniper patches multiple vulnerabilities in Junos OS and other products (April 2022)

By / / Network Security, Security Updates & Patches, Vulnerabilities & Exploits / Jun OS, Juniper, Networking

Juniper Networks has released security advisories to fix many vulnerabilities on Junos OS and multiple other products.

An attacker could exploit these vulnerabilities and potentially take over impacted systems.

Juniper released the following patches on April 13, 2022:

  1. Junos OS Evolved: Specific packets reaching the RE lead to a counter overflow and eventually a crash (CVE-2022-22195)
  2. Junos OS and Junos OS Evolved: The rpd CPU spikes to 100% after a malformed ISIS TLV has been received (CVE-2022-22196)
  3. Junos OS and Junos OS Evolved: An rpd core will be observed with proxy BGP route-target filtering enabled and certain route add and delete event happening (CVE-2022-22197)
  4. Junos OS: J-Web can be compromised through reflected XSS attacks (CVE-2022-22181)
  5. Junos OS Evolved: A remote attacker may cause a CPU Denial of Service by sending genuine traffic to a device on a specific IPv4 port. (CVE-2022-22183)
  6. Junos OS and Junos OS Evolved: In a BGP rib-sharding scenario when a certain CLI command is executed the rpd process might crash (CVE-2022-22193)Y
  7. Junos OS: A XSS vulnerability allows an attacker to execute commands on a target J-Web session (CVE-2022-22182)
  8. Junos OS: SRX Series: Denial of service vulnerability in flowd daemon upon receipt of a specific fragmented packet (CVE-2022-22185)Y
  9. Junos OS: vSRX 3.0 model: FreeBSD-SA-20:26.dhclient heap overflow (CVE-2020-7461)
  10. Junos OS: EX4300: PFE Denial of Service (DoS) upon receipt of a flood of specific ARP traffic (CVE-2022-22191)
  11. Paragon Active Assurance Control Center: Information disclosure vulnerability in crafted URL (CVE-2022-22190)
  12. Paragon Active Assurance: Local Privilege Escalation in polkit’s pkexec (CVE-2021-4034)Y
  13. Junos OS: MS-MPC or MS-MIC, or SPC crashes if it receives a SIP message with a specific contact header format (CVE-2022-22198)
  14. Junos OS Evolved: PTX series: An attacker sending a crafted GRE packet will cause the PFE to restart (CVE-2022-22194)
  15. Contrail Networking: Multiple vulnerabilities resolved in Contrail Networking 21.3
  16. Junos OS: QFX5100/QFX5110/QFX5120/QFX5200/QFX5210/EX4600/EX4650 Series: When storm control profiling is enabled and a device is under an active storm, a Heap-based Buffer Overflow in the PFE will cause a device to hang.
  17. JIMS: Local Privilege Escalation vulnerability via repair functionality (CVE-2022-22187)
  18. Contrail Service Orchestration: An authenticated local user may have their permissions elevated via the device via management interface without authentication (CVE-2022-22189)
  19. Junos OS: EX4650 Series: Certain traffic received by the Junos OS device on the management interface may be forwarded to egress interfaces instead of discarded (CVE-2022-22186)
  20. Contrail Networking: Multiple Vulnerabilities have been resolved in Contrail Networking release 2011.L4
  21. Juniper Secure Analytics: JSA Series: Heap-Based Buffer Overflow in Sudo (CVE-2021-3156).

Moreover, Juniper also released multiple security updates for other products earlier in April, 2022.

Related Articles