6.5

CVE-2023-36849

Junos OS and Junos OS Evolved: The l2cpd will crash when a malformed LLDP packet is received

An Improper Check or Handling of Exceptional Conditions vulnerability in the Layer-2 control protocols daemon (l2cpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS).

When a malformed LLDP packet is received, l2cpd will crash and restart. The impact of the l2cpd crash is reinitialization of STP protocols (RSTP, MSTP or VSTP), and MVRP and ERP. Also, if any services depend on LLDP state (like PoE or VoIP device recognition), then these will also be affected. Continued receipt of such packets will lead to a sustained Denial of Service.

This issue affects:
Juniper Networks Junos OS
21.4 versions prior to 21.4R3-S3;
22.1 versions prior to 22.1R3-S3;
22.2 versions prior to 22.2R2-S1, 22.2R3;
22.3 versions prior to 22.3R2.

Juniper Networks Junos OS Evolved
21.4-EVO versions prior to 21.4R3-S2-EVO;
22.1-EVO versions prior to 22.1R3-S3-EVO;
22.2-EVO versions prior to 22.2R2-S1-EVO, 22.2R3-EVO;
22.3-EVO versions prior to 22.3R2-EVO.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Juniper ≫ Junos Version 21.4 Update -
Juniper ≫ Junos Version 21.4 Update r1
Juniper ≫ Junos Version 21.4 Update r1-s1
Juniper ≫ Junos Version 21.4 Update r1-s2
Juniper ≫ Junos Version 21.4 Update r2
Juniper ≫ Junos Version 21.4 Update r2-s1
Juniper ≫ Junos Version 21.4 Update r2-s2
Juniper ≫ Junos Version 21.4 Update r3
Juniper ≫ Junos Version 21.4 Update r3-s1
Juniper ≫ Junos Version 21.4 Update r3-s2
Juniper ≫ Junos Version 22.1 Update r1
Juniper ≫ Junos Version 22.1 Update r1-s1
Juniper ≫ Junos Version 22.1 Update r1-s2
Juniper ≫ Junos Version 22.1 Update r2
Juniper ≫ Junos Version 22.1 Update r2-s1
Juniper ≫ Junos Version 22.1 Update r2-s2
Juniper ≫ Junos Version 22.1 Update r3
Juniper ≫ Junos Version 22.1 Update r3-s1
Juniper ≫ Junos Version 22.1 Update r3-s2
Juniper ≫ Junos Version 22.2 Update r1
Juniper ≫ Junos Version 22.2 Update r1-s1
Juniper ≫ Junos Version 22.2 Update r1-s2
Juniper ≫ Junos Version 22.2 Update r2
Juniper ≫ Junos Version 22.3 Update r1
Juniper ≫ Junos Version 22.3 Update r1-s1
Juniper ≫ Junos Version 22.3 Update r1-s2
Juniper ≫ Junos Os Evolved Version 21.4 Update -
Juniper ≫ Junos Os Evolved Version 21.4 Update r1
Juniper ≫ Junos Os Evolved Version 21.4 Update r1-s1
Juniper ≫ Junos Os Evolved Version 21.4 Update r1-s2
Juniper ≫ Junos Os Evolved Version 21.4 Update r2
Juniper ≫ Junos Os Evolved Version 21.4 Update r2-s1
Juniper ≫ Junos Os Evolved Version 21.4 Update r2-s2
Juniper ≫ Junos Os Evolved Version 21.4 Update r3
Juniper ≫ Junos Os Evolved Version 21.4 Update r3-s1
Juniper ≫ Junos Os Evolved Version 22.1 Update r1
Juniper ≫ Junos Os Evolved Version 22.1 Update r1-s1
Juniper ≫ Junos Os Evolved Version 22.1 Update r1-s2
Juniper ≫ Junos Os Evolved Version 22.1 Update r2
Juniper ≫ Junos Os Evolved Version 22.1 Update r2-s1
Juniper ≫ Junos Os Evolved Version 22.1 Update r3
Juniper ≫ Junos Os Evolved Version 22.1 Update r3-s1
Juniper ≫ Junos Os Evolved Version 22.1 Update r3-s2
Juniper ≫ Junos Os Evolved Version 22.2 Update r1
Juniper ≫ Junos Os Evolved Version 22.2 Update r1-s1
Juniper ≫ Junos Os Evolved Version 22.2 Update r2
Juniper ≫ Junos Os Evolved Version 22.3 Update r1
Juniper ≫ Junos Os Evolved Version 22.3 Update r1-s1
Juniper ≫ Junos Os Evolved Version 22.3 Update r1-s2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.3% 0.222
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Juniper 6.5 2.8 3.6
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-703 Improper Check or Handling of Exceptional Conditions

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

https://supportportal.juniper.net/JSA71660
Vendor Advisory
Mitigation