CVE-2021-0249
published 2021-04-22CVE-2021-0249: On SRX Series devices configured with UTM services a buffer overflow vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS may allow…
PriorityP264critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.84%
76.6th percentile
On SRX Series devices configured with UTM services a buffer overflow vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS may allow an attacker to arbitrarily execute code or commands on the target to take over or otherwise impact the device by sending crafted packets to or through the device. This issue affects: Juniper Networks Junos OS on SRX Series: 15.1X49 versions prior to 15.1X49-D190; 17.4 versions prior to 17.4R2-S9; 17.4R3 and later versions prior to 18.1R3-S9; 18.2 versions prior to 18.2R3-S1; 18.3 versions prior to 18.3R2-S3, 18.3R3; 18.4 versions prior to 18.4R2-S3, 18.4R3; 19.1 versions prior to 19.1R1-S4, 19.1R2; 19.2 versions prior to 19.2R1-S1, 19.2R2. An indicator of compromise can be the following text in the UTM log: RT_UTM: AV_FILE_NOT_SCANNED_PASSED_MT:
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos_os | — | — |
| juniper | srx_series | — | — |
| juniper_networks | junos_os | >= 15.1X49 < 15.1X49-D190 | 15.1X49-D190 |
| juniper_networks | junos_os | >= 17.4 < 17.4R2-S9 | 17.4R2-S9 |
| juniper_networks | junos_os | >= 18.1 < 18.1R3-S9 | 18.1R3-S9 |
| juniper_networks | junos_os | >= 18.2 < 18.2R3-S1 | 18.2R3-S1 |
| juniper_networks | junos_os | >= 18.3 < 18.3R2-S3, 18.3R3 | 18.3R2-S3, 18.3R3 |
| juniper_networks | junos_os | >= 18.4 < 18.4R2-S3, 18.4R3 | 18.4R2-S3, 18.4R3 |
| juniper_networks | junos_os | >= 19.1 < 19.1R1-S4, 19.1R2 | 19.1R1-S4, 19.1R2 |
| juniper_networks | junos_os | >= 19.2 < 19.2R1-S1, 19.2R2 | 19.2R1-S1, 19.2R2 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor UTM logs on Juniper SRX Series devices for the IoC log string 'RT_UTM: AV_FILE_NOT_SCANNED_PASSED_MT:' which indicates exploitation of the PFE buffer overflow via crafted packets traversing UTM services. ↗
- →The vulnerability is triggered by sending crafted packets to or through an SRX Series device configured with UTM services; inspect ingress/egress traffic for anomalous or malformed packets targeting UTM-enabled interfaces. ↗
- ·Vulnerability only affects SRX Series devices that have UTM (Unified Threat Management) services configured; devices without UTM enabled are not affected. ↗
- ·Affected Junos OS versions on SRX Series: 15.1X49 prior to 15.1X49-D190; 17.4 prior to 17.4R2-S9; 17.4R3 and later prior to 18.1R3-S9; 18.2 prior to 18.2R3-S1; 18.3 prior to 18.3R2-S3/18.3R3; 18.4 prior to 18.4R2-S3/18.4R3; 19.1 prior to 19.1R1-S4/19.1R2; 19.2 prior to 19.2R1-S1/19.2R2. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Juniper
CVE-2021-0249: On SRX Series devices configured with UTM services a buffer overflow vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS
vendor_juniper·2021-04-22·CVSS 8.1
CVE-2021-0249 [HIGH] CWE-120 CVE-2021-0249: On SRX Series devices configured with UTM services a buffer overflow vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS
CVE-2021-0249: On SRX Series devices configured with UTM services a buffer overflow vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS may allow an attacker to arbitrarily execute code or commands on the target to take over or otherwise impact the device by sending crafted packets to or through the device. This issue affects: Juniper Networks Junos OS on SRX Series: 15.1X49 versions prior to 15.1X49-D190; 17.4 versions prior to 17.4R2-S9; 17.4R3 and later versions prior to 18.1R3-S9; 18.2 versions prior to 18.2R3-S1; 18.3 versions prior to 18.3R2-S3, 18.3R3; 18.4 versions prior to 18.4R2-S3, 18.4R3; 19.1 versions prior to 19.1R1-S4, 19.1R2; 19.2 versions prior to 19.2R1-S1, 19.2R2. An indicator of compromise can be the following text in the UTM log: RT_UTM: AV
GHSA
GHSA-4cwf-q6r9-gq5q: On SRX Series devices configured with UTM services a buffer overflow vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS
ghsa_unreviewed·2022-05-24
CVE-2021-0249 [HIGH] CWE-120 GHSA-4cwf-q6r9-gq5q: On SRX Series devices configured with UTM services a buffer overflow vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS
On SRX Series devices configured with UTM services a buffer overflow vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS may allow an attacker to arbitrarily execute code or commands on the target to take over or otherwise impact the device by sending crafted packets to or through the device. This issue affects: Juniper Networks Junos OS on SRX Series: 15.1X49 versions prior to 15.1X49-D190; 17.4 versions prior to 17.4R2-S9; 17.4R3 and later versions prior to 18.1R3-S9; 18.2 versions prior to 18.2R3-S1; 18.3 versions prior to 18.3R2-S3, 18.3R3; 18.4 versions prior to 18.4R2-S3, 18.4R3; 19.1 versions prior to 19.1R1-S4, 19.1R2; 19.2 versions prior to 19.2R1-S1, 19.2R2. An indicator of compromise can be the following text in the UTM log: RT_UTM: AV_FILE_NOT_SCANN
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-04-22
Published