Support Support Downloads Knowledge Base Case Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

2020-04 Security Bulletin: Junos OS and Junos OS Evolved: Invalid BGP UPDATE sent to peer device may cause BGP session to terminate. (CVE-2020-1632)

0

0

Article ID: JSA11013 SECURITY_ADVISORIES Last Updated: 08 Apr 2020Version: 3.0
Product Affected:
This issue affects Junos OS 16.1, 16.2, 17.1, 17.2, 17.2X75, 17.3, 17.4, 18.1, 18.2, 18.2X75, 18.3, 18.4, 19.1, 19.2. This issue affects Junos OS Evolved.
Problem:

In a certain condition, receipt of a specific BGP UPDATE message might cause Juniper Networks Junos OS and Junos OS Evolved devices to advertise an invalid BGP UPDATE message to other peers, causing the other peers to terminate the established BGP session, creating a Denial of Service (DoS) condition. For example, Router A sends a specific BGP UPDATE to Router B, causing Router B to send an invalid BGP UPDATE message to Router C, resulting in termination of the BGP session between Router B and Router C.

This issue might occur when there is at least a single BGP session established on the device that does not support 4 Byte AS extension (RFC 4893).

Repeated receipt of the same BGP UPDATE can result in an extended DoS condition.

This issue affects Juniper Networks Junos OS:

16.1 versions prior to 16.1R7-S6;

16.2 versions prior to 16.2R2-S11;

17.1 versions prior to 17.1R2-S11, 17.1R3-S2;

17.2 versions prior to 17.2R1-S9, 17.2R2-S8, 17.2R3-S3;

17.2X75 versions prior to 17.2X75-D105, 17.2X75-D110, 17.2X75-D44;

17.3 versions prior to 17.3R2-S5, 17.3R3-S7;

17.4 versions prior to 17.4R2-S8, 17.4R3;

18.1 versions prior to 18.1R3-S8;

18.2 versions prior to 18.2R2-S6, 18.2R3-S2;

18.2X75 versions prior to 18.2X75-D12, 18.2X75-D33, 18.2X75-D411, 18.2X75-D420, 18.2X75-D51, 18.2X75-D60;

18.3 versions prior to 18.3R1-S6, 18.3R2-S3, 18.3R3;

18.4 versions prior to 18.4R1-S5, 18.4R3;

18.4 version 18.4R2 and later versions;

19.1 versions prior to 19.1R1-S3, 19.1R2;

19.2 versions prior to 19.2R1-S2, 19.2R2.

This issue does not affect Juniper Networks Junos OS prior to 16.1R1.

This issue affects Juniper Networks Junos OS Evolved prior to 19.2R2-EVO.

The following command can be used to check if the peer device does not support 4-Byte AS extension:

user@device> show bgp neighbor
  ...
  Peer does not support 4 byte AS extension
  ...

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was seen during production usage.

This issue has been assigned CVE-2020-1632.

Solution:

Junos OS: 16.1R7-S6, 16.2R2-S11, 17.1R2-S11, 17.1R3-S2, 17.2R1-S9, 17.2R2-S8, 17.2R3-S3, 17.2X75-D105, 17.2X75-D110, 17.2X75-D44, 17.3R2-S5, 17.3R3-S7, 17.4R2-S8, 17.4R3, 18.1R3-S8, 18.2R2-S6, 18.2R3-S2, 18.2X75-D12, 18.2X75-D33, 18.2X75-D411, 18.2X75-D420, 18.2X75-D51, 18.2X75-D60, 18.3R1-S6, 18.3R2-S3, 18.3R3, 18.4R1-S5, 18.4R3, 19.1R1-S3, 19.1R2, 19.2R1-S2, 19.2R2, 19.3R1, and all subsequent releases.

Junos OS Evolved: 19.2R2-EVO, 19.3R1-EVO and all subsequent releases.

This issue is being tracked as 1454677.

Workaround:

There are no viable workarounds for this issue.

Implementation:
Software Releases, patches and updates are available at https://www.juniper.net/support/downloads/.
Modification History:
‚Äč2020-04-08: Initial publication
2020-04-08: Removing description section related to 2 possible conditions (previously the statement "However, if all the "show bgp neighbor" outputs contain the line "Peer does not support 4 byte AS extension", this issue is not exposed." is not correct.
CVSS Score:
8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Severity Level:
High
Severity Assessment:
Information for how Juniper Networks uses CVSS can be found at KB 16446 "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Related Links

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search