CVE-2021-0249

Summary

On SRX Series devices configured with UTM services a buffer overflow vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS may allow an attacker to arbitrarily execute code or commands on the target to take over or otherwise impact the device by sending crafted packets to or through the device. This issue affects: Juniper Networks Junos OS on SRX Series: 15.1X49 versions prior to 15.1X49-D190; 17.4 versions prior to 17.4R2-S9; 17.4R3 and later versions prior to 18.1R3-S9; 18.2 versions prior to 18.2R3-S1; 18.3 versions prior to 18.3R2-S3, 18.3R3; 18.4 versions prior to 18.4R2-S3, 18.4R3; 19.1 versions prior to 19.1R1-S4, 19.1R2; 19.2 versions prior to 19.2R1-S1, 19.2R2. An indicator of compromise can be the following text in the UTM log: RT_UTM: AV_FILE_NOT_SCANNED_PASSED_MT:

Affected Software

VendorProductVersion RangeStatus
Juniper NetworksJunos OS15.1X49 < 15.1X49-D190affected
Juniper NetworksJunos OS17.4 < 17.4R2-S9affected
Juniper NetworksJunos OS18.1 < 18.1R3-S9affected
Juniper NetworksJunos OS18.2 < 18.2R3-S1affected
Juniper NetworksJunos OS18.3 < 18.3R2-S3, 18.3R3affected
Juniper NetworksJunos OS18.4 < 18.4R2-S3, 18.4R3affected
Juniper NetworksJunos OS19.1 < 19.1R1-S4, 19.1R2affected
Juniper NetworksJunos OS19.2 < 19.2R1-S1, 19.2R2affected

Weaknesses

  • Remote Code Execution
  • Remote Command Execution
  • Local Code Execution
  • Local Command Execution
  • CWE-120: CWE-120 Buffer Overflow

Workarounds

There are no available workarounds for this issue other than disabling UTM services.

ADP Enrichment

CVE Program Container

Additional References

References