NULL Pointer Dereference in Juniper Networks Junos OS MX Series

Executive Summary

This is a NULL Pointer Dereference vulnerability in Juniper Networks Junos OS and Junos OS Evolved. It occurs in the rpd process on MX Series and ACX Series devices. An unauthenticated attacker on the same network can send a specially crafted IGMPv3 membership report to cause a denial of service by crashing the rpd process.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for crashes or instability in the rpd process on affected Juniper MX Series or ACX Series devices running Junos OS or Junos OS Evolved. Check for IGMPv3 membership reports causing unexpected behavior. Use 'show system processes extensive' to monitor rpd and 'show log messages' for crash logs.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker to disrupt network services by causing the rpd process to crash. This can lead to loss of routing functionality, network outages, or degraded performance on affected Juniper MX and ACX Series devices.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service via an IGMPv3 membership report, which could disrupt network services. Such disruptions may impact compliance with standards requiring availability of systems, such as GDPR (data processing continuity) and HIPAA (service availability for protected health information).

Useful 0 Not Useful 0

Mitigation Strategies

Update Junos OS or Junos OS Evolved to the latest patched version to address the NULL Pointer Dereference vulnerability in the rpd process.

Useful 0 Not Useful 0