Junos mbuf Denial of Service Vulnerability

Junos OS is prone to a DoS vulnerability by mbuf exhaustion.

When an active TCP connection transitions to LAST_ACK state and the daemon connected to the socket still has more data to send, the socket could get stuck in LAST_ACK state indefinitely, using up finite mbufs and connections. Exploitation of this issue requires establishment of a TCP connection to a listening port on the router. TCP ports protected by ingress and/or control plane firewall filters are not vulnerable to this issue. However, anti-spoofing mechanisms should be employed to protect against malicious attempts to bypass existing firewall filters.

Junos OS 12.1, 12.3, 13.2, 13.3, 14.1 and 14.2

Checks if a vulnerable OS build is present on the target host.

New builds of Junos OS software are available from Juniper.