CVE-2021-0261

Summary

A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Captive Portal allows an unauthenticated attacker to cause an extended Denial of Service (DoS) for these services by sending a high number of specific requests. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S17 on EX Series; 12.3X48 versions prior to 12.3X48-D105 on SRX Series; 15.1 versions prior to 15.1R7-S8; 15.1X49 versions prior to 15.1X49-D230 on SRX Series; 16.1 versions prior to 16.1R7-S8; 17.4 versions prior to 17.4R2-S12, 17.4R3-S3; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S6; 18.3 versions prior to 18.3R2-S4, 18.3R3-S3; 18.4 versions prior to 18.4R2-S5, 18.4R3-S4; 19.1 versions prior to 19.1R2-S2, 19.1R3-S2; 19.2 versions prior to 19.2R1-S5, 19.2R3; 19.3 versions prior to 19.3R2-S4, 19.3R3; 19.4 versions prior to 19.4R1-S3, 19.4R2-S2, 19.4R3; 20.1 versions prior to 20.1R1-S3, 20.1R2; 20.2 versions prior to 20.2R1-S1, 20.2R2.

Affected Software

VendorProductVersion RangeStatus
Juniper NetworksJunos OS12.3 < 12.3R12-S17affected
Juniper NetworksJunos OS12.3X48 < 12.3X48-D105affected
Juniper NetworksJunos OS15.1X49 < 15.1X49-D230affected
Juniper NetworksJunos OS15.1 < 15.1R7-S8affected
Juniper NetworksJunos OS16.1 < 16.1R7-S8affected
Juniper NetworksJunos OS17.4 < 17.4R2-S12, 17.4R3-S3affected
Juniper NetworksJunos OS18.1 < 18.1R3-S11affected
Juniper NetworksJunos OS18.2 < 18.2R3-S6affected
Juniper NetworksJunos OS18.3 < 18.3R2-S4, 18.3R3-S3affected
Juniper NetworksJunos OS18.4 < 18.4R2-S5, 18.4R3-S4affected
Juniper NetworksJunos OS19.1 < 19.1R2-S2, 19.1R3-S2affected
Juniper NetworksJunos OS19.2 < 19.2R1-S5, 19.2R3affected
Juniper NetworksJunos OS19.3 < 19.3R2-S4, 19.3R3affected
Juniper NetworksJunos OS19.4 < 19.4R1-S3, 19.4R2-S2, 19.4R3affected
Juniper NetworksJunos OS20.1 < 20.1R1-S3, 20.1R2affected
Juniper NetworksJunos OS20.2 < 20.2R1-S1, 20.2R2affected

Weaknesses

  • CWE-125: CWE-125 Out-of-bounds Read
  • Denial of Service (DoS)
  • CWE-770: CWE-770 Allocation of Resources Without Limits or Throttling

Workarounds

There are no viable workarounds for this issue other than disabling the web-service: [deactivate system services web-management]

To reduce the risk of exploitation utilize common security BCPs to limit the exploitable surface by limiting access to network and device to trusted systems, administrators, networks and hosts.

The 'restart web-management' command can be used to restart the web-service to recover from this issue.

ADP Enrichment

CVE Program Container

Additional References

References