CVE-2022-22177 An attacker can release an snmpd memory vulnerability and stop the snmpd daemon, causing a Denial of Service. This vulnerability is fixed in version 12.2R15.
This issue was fixed in Junos OS Evolved 10.1, 10.2, 10.3, 10.4, 11.1, 11.2, 12.1, 12.3, 12.3R, 12.3R1, 15.1, and 18.3 versions. For all versions of Junos OS prior to 15.1R6-S13, upgrade to 15.1R5-S9 or later. This issue was fixed in Junos OS Evolved 10.1, 10.2, 10.3, 10.4, 11.1, 11.2, 12.1, 12.3, 12.3R, 12.3R1, 15.1, and 18.3 versions. For all versions of Junos OS prior to 15.1R6-S13, upgrade to 15.1R5-S9 or later.
Instructions for AP8021 and AP8022 Series Devices:
AP8021 and AP8022 Series devices are vulnerable to CVE-2022-22177 when configured for both the IPv4 unicast routing protocol and the IPv6 unicast routing protocol. To mitigate this issue, configure these devices to only use one of the two protocols.
To mitigate this issue, configure a Junos OS system as follows:
# set interfaces ge-0/0/0 unit 0 family inet address dhcp;
# set interfaces ge-0/0/1 unit 0 family inet address dhcp;
# set interfaces ge-1/1/1 unit 0 family inet address dhcp;
# set protocols ospfv3 area 0.0.10.10 { interface ge-0/0/2.2 { } interface ge-1/1/1.3 { } }
Overview of the Issue
A vulnerability in Junos OS allows an unauthenticated remote attacker to execute arbitrary commands on the device via a crafted request. This vulnerability is exploitable by an unauthenticated attacker on the local network, or remotely over the Internet.
This issue was fixed in Junos OS Evolved 10.1, 10.2, 10.3, 10.4, 11.1, 11.2, 12.1, 12.3, 12.3R, 12.3R1 (CVE-2022-22177), 15.1 (CVE-2018-12426), and 18.3 (CVE-2019-0599). For all versions of Junos OS prior to 15.1R6-S13 upgrade to 15.1R5-S9 or later for mitigation of this issue if it is found in production use today or in tomorrow's release candidate code stream for Junos OS 15.
Products and versions affected
All products running Junos OS prior to Junos OS Evolved 15.1R6-S13 that have not been upgraded to 15.1R5-S9 or later are vulnerable.
The following products are affected:
Juniper SRX Series Services Gateways with Junos OS before 10.4R7
Juniper J-Series Network Devices with Junos OS before 11.2R11 and 12.3R8
Juniper MX Series Ethernet Switches with Junos OS before 12.3R8
Timeline
Published on: 01/19/2022 01:15:00 UTC
Last modified on: 01/26/2022 19:16:00 UTC