Critical RCE can allow attackers to compromise Juniper Networks devices

Cybersecurity provider Juniper Networks addressed a critical vulnerability that could be exploited by attackers to remotely hijack or disrupt vulnerable devices.

Cybersecurity vendor Juniper Networks addressed a critical vulnerability in Junos OS, tracked as CVE-2021-0254, that could allow an attacker to remotely hijack or disrupt affected devices. This flaw stems from the improper buffer size validation, which can lead to a buffer overflow.

The vulnerability is a remote code execution vulnerability in overlayd service that affects Junos OS 15.1X49, 15.1, 17.3, 17.4, 18.1, 18.2, 18.3, 18.4, 19.1, 19.2, 19.3, 19.4, 20.1, 20.2, 20.3.

“A buffer size validation vulnerability in the overlayd service of Juniper Networks Junos OS may allow an unauthenticated remote attacker to send specially crafted packets to the device, triggering a partial Denial of Service (DoS) condition, or leading to remote code execution (RCE). Continued receipt and processing of these packets will sustain the partial DoS.” reads the security advisory published by the company. “The overlayd daemon handles Overlay OAM packets, such as ping and traceroute, sent to the overlay. The service runs as root by default and listens for UDP connections on port 4789. This issue results from improper buffer size validation, which can lead to a buffer overflow. Unauthenticated attackers can send specially crafted packets to trigger this vulnerability, resulting in possible remote code execution.”

The flaw can be exploited by a remote, unauthenticated attacker to execute arbitrary code of a vulnerable device or to trigger a DoS condition. The vulnerability can be exploited by sending specially crafted packets to the targeted system.

The flaw was reported by security researchers Nguyễn Hoàng Thạch, aka d4rkn3ss, from cybersecurity company STAR Labs.

An attacker could trigger the flaw to install a backdoor on a vulnerable device or to change its configuration.

Juniper SIRT revealed that it is not aware of any attacks in the wild exploiting the above flaw.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) also published a security alert to encourage users and administrators to review the Juniper Security Advisories webpage and apply the necessary updates or workarounds.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Juniper)

[adrotate banner=”5″]

[adrotate banner=”13″]