Integer Underflow in Juniper Junos OS via Rosen-MVPN

Executive Summary

This is an Integer Underflow vulnerability in Juniper Networks Junos OS and Junos OS Evolved. It affects the rpd process on EX, MX, and ACX Series devices that support draft Rosen MVPN. An unauthenticated adjacent attacker can exploit a malformed Rosen-MVPN message to cause heap memory disclosure and inject multicast join-state.

Useful 0 Not Useful 0

Detection Guidance

Detection requires monitoring for malformed Rosen-MVPN messages on affected Juniper devices. Check logs for rpd process crashes or heap memory disclosures. Use 'show system processes extensive | match rpd' to verify rpd status and 'show log messages | match MVPN' to inspect multicast join-state logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could read sensitive memory contents or manipulate multicast group memberships. This may lead to information leaks or unauthorized network traffic redirection. The impact is limited to networks using affected Juniper devices with draft Rosen MVPN enabled.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may lead to unauthorized access or disclosure of sensitive data due to heap memory disclosure and multicast join-state injection, which could violate data protection requirements under GDPR and HIPAA if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest Junos OS or Junos OS Evolved security patches from Juniper Networks. Disable draft Rosen MVPN if not required. Monitor network traffic for malformed Rosen-MVPN messages.

Useful 0 Not Useful 0