Vulnerability · Published Jan 15, 2021 · Assigned by juniper
CVE-2021-0205Junos OS: MX Series: Dynamic filter fails to match IPv6 prefix
Medium 5.8
In plain English
A medium-severity improper access control in Junos OS from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).
Official description
When the "Intrusion Detection Service" (IDS) feature is configured on Juniper Networks MX series with a dynamic firewall filter using IPv6 source or destination prefix, it may incorrectly match the prefix as /32, causing the filter to block unexpected traffic. This issue affects only IPv6 prefixes when used as source and destination. This issue affects MX Series devices using MS-MPC, MS-MIC or MS-SPC3 service cards with IDS service configured. This issue affects: Juniper Networks Junos OS 17.3 versions prior to 17.3R3-S10 on MX Series; 17.4 versions prior to 17.4R3-S3 on MX Series; 18.1 versions prior to 18.1R3-S11 on MX Series; 18.2 versions prior to 18.2R3-S6 on MX Series; 18.3 versions prior to 18.3R3-S4 on MX Series; 18.4 versions prior to 18.4R3-S6 on MX Series; 19.1 versions prior to 19.1R2-S2, 19.1R3-S3 on MX Series; 19.2 versions prior to 19.2R3-S1 on MX Series; 19.3 versions prior to 19.3R2-S5, 19.3R3-S1 on MX Series; 19.4 versions prior to 19.4R3 on MX Series; 20.1 versions prior to 20.1R2 on MX Series; 20.2 versions prior to 20.2R2 on MX Series;
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Juniper Networks | Junos OS | 17.3 – before 17.3R3-S1017.4 – before 17.4R3-S318.1 – before 18.1R3-S1118.2 – before 18.2R3-S618.3 – before 18.3R3-S418.4 – before 18.4R3-S619.1 – before 19.1R2-S2, 19.1R3-S319.2 – before 19.2R3-S1 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
References
- https://kb.juniper.net/JSA11095 x_refsource_CONFIRM