When user-defined ARP Policer is configured and applied on one or more Aggregated Ethernet (AE) interface units, a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability between the Device Control Daemon (DCD) and firewall process (dfwd) daemons of Juniper Networks Junos OS allows an attacker to bypass the user-defined ARP Policer. In this particular case the User ARP policer is replaced with default ARP policer. To review the desired ARP Policers and actual state one can run the command "show interfaces <> extensive" and review the output. See further details below. An example output is: show interfaces extensive | match policer Policer: Input: __default_arp_policer__ <<< incorrect if user ARP Policer was applied on an AE interface and the default ARP Policer is displayed Policer: Input: jtac-arp-ae5.317-inet-arp <<< correct if user ARP Policer was applied on an AE interface For all platforms, except SRX Series: This issue affects Juniper Networks Junos OS: All versions 5.6R1 and all later versions prior to 18.4 versions prior to 18.4R2-S9, 18.4R3-S9 with the exception of 15.1 versions 15.1R7-S10 and later versions; 19.4 versions prior to 19.4R3-S3; 20.1 versions prior to 20.1R3; 20.2 versions prior to 20.2R3-S2; 20.3 version 20.3R1 and later versions; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2; This issue does not affect Juniper Networks Junos OS versions prior to 5.6R1. On SRX Series this issue affects Juniper Networks Junos OS: 18.4 versions prior to 18.4R2-S9, 18.4R3-S9; 19.4 versions prior to 19.4R3-S4; 20.1 versions prior to 20.1R3; 20.2 versions prior to 20.2R3-S2; 20.3 version 20.3R1 and later versions; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2. This issue does not affect 18.4 versions prior to 18.4R1 on SRX Series. This issue does not affect Junos OS Evolved.

Project Subscriptions

Vendors Products
Juniper Subscribe
Acx1000 Subscribe
Acx1100 Subscribe
Acx2000 Subscribe
Acx2100 Subscribe
Acx2200 Subscribe
Acx4000 Subscribe
Acx5000 Subscribe
Acx5048 Subscribe
Acx5096 Subscribe
Acx5400 Subscribe
Acx5448 Subscribe
Acx5800 Subscribe
Acx6300 Subscribe
Acx6360 Subscribe
Ctp2008 Subscribe
Ctp2024 Subscribe
Ctp2056 Subscribe
Ex2200-c Subscribe
Ex2200-vc Subscribe
Ex2300-c Subscribe
Ex2300m Subscribe
Ex3300-vc Subscribe
Ex4200-vc Subscribe
Ex4300-24p Subscribe
Ex4300-24p-s Subscribe
Ex4300-24t Subscribe
Ex4300-24t-s Subscribe
Ex4300-32f Subscribe
Ex4300-32f-dc Subscribe
Ex4300-32f-s Subscribe
Ex4300-48mp Subscribe
Ex4300-48mp-s Subscribe
Ex4300-48p Subscribe
Ex4300-48p-s Subscribe
Ex4300-48t Subscribe
Ex4300-48t-afi Subscribe
Ex4300-48t-dc Subscribe
Ex4300-48t-dc-afi Subscribe
Ex4300-48t-s Subscribe
Ex4300-48tafi Subscribe
Ex4300-48tdc Subscribe
Ex4300-48tdc-afi Subscribe
Ex4300-mp Subscribe
Ex4300-vc Subscribe
Ex4300m Subscribe
Ex4500-vc Subscribe
Ex4550-vc Subscribe
Ex4550\/vc Subscribe
Ex4600-vc Subscribe
Ex8200-vc Subscribe
Fips Infranet Controller 6500 Subscribe
Fips Secure Access 4000 Subscribe
Fips Secure Access 4500 Subscribe
Fips Secure Access 6000 Subscribe
Fips Secure Access 6500 Subscribe
Gfx3600 Subscribe
Idp8200 Subscribe
Infranet Controller 4000 Subscribe
Infranet Controller 4500 Subscribe
Infranet Controller 6000 Subscribe
Infranet Controller 6500 Subscribe
Junos Space Ja1500 Appliance Subscribe
Junos Space Ja2500 Appliance Subscribe
Mag2600 Gateway Subscribe
Mag4610 Gateway Subscribe
Mag6610 Gateway Subscribe
Mag6611 Gateway Subscribe
Mx10000 Subscribe
Mx10003 Subscribe
Mx10008 Subscribe
Mx10016 Subscribe
Netscreen-5200 Subscribe
Netscreen-5400 Subscribe
Netscreen-5gt Subscribe
Netscreen-idp Subscribe
Netscreen-idp 10 Subscribe
Netscreen-idp 100 Subscribe
Netscreen-idp 1000 Subscribe
Netscreen-idp 500 Subscribe
Nsm3000 Subscribe
Nsmexpress Subscribe
Ocx1100 Subscribe
Ptx1000 Subscribe
Ptx1000-72q Subscribe
Ptx10000 Subscribe
Ptx10001 Subscribe
Ptx10001-36mr Subscribe
Ptx100016 Subscribe
Ptx10002 Subscribe
Ptx10002-60c Subscribe
Ptx10003 Subscribe
Ptx10003 160c Subscribe
Ptx10003 80c Subscribe
Ptx10003 81cd Subscribe
Ptx10004 Subscribe
Ptx10008 Subscribe
Ptx10016 Subscribe
Ptx3000 Subscribe
Ptx5000 Subscribe
Qfx10000 Subscribe
Qfx10002 Subscribe
Qfx10002-32q Subscribe
Qfx10002-60c Subscribe
Qfx10002-72q Subscribe
Qfx10008 Subscribe
Qfx10016 Subscribe
Qfx3000-g Subscribe
Qfx3000-m Subscribe
Qfx3008-i Subscribe
Qfx3100 Subscribe
Qfx3500 Subscribe
Qfx3600 Subscribe
Qfx3600-i Subscribe
Qfx5100 Subscribe
Qfx5100-96s Subscribe
Qfx5110 Subscribe
Qfx5120 Subscribe
Qfx5130 Subscribe
Qfx5200 Subscribe
Qfx5200-32c Subscribe
Qfx5200-48y Subscribe
Qfx5210 Subscribe
Qfx5210-64c Subscribe
Qfx5220 Subscribe
Router M10 Subscribe
Router M16 Subscribe
Router M20 Subscribe
Router M40 Subscribe
Router M5 Subscribe
Secure Access 2000 Subscribe
Secure Access 2500 Subscribe
Secure Access 4000 Subscribe
Secure Access 4500 Subscribe
Secure Access 6000 Subscribe
Secure Access 6500 Subscribe
Secure Access 700 Subscribe
Srx1400 Subscribe
Srx1500 Subscribe
Srx240h2 Subscribe
Srx3400 Subscribe
Srx3600 Subscribe
Srx4000 Subscribe
Srx4100 Subscribe
Srx4200 Subscribe
Srx4600 Subscribe
Srx5000 Subscribe
Srx5400 Subscribe
Srx550 Hm Subscribe
Srx550m Subscribe
Srx5600 Subscribe
Srx5800 Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2021-2908 When user-defined ARP Policer is configured and applied on one or more Aggregated Ethernet (AE) interface units, a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability between the Device Control Daemon (DCD) and firewall process (dfwd) daemons of Juniper Networks Junos OS allows an attacker to bypass the user-defined ARP Policer. In this particular case the User ARP policer is replaced with default ARP policer. To review the desired ARP Policers and actual state one can run the command "show interfaces <> extensive" and review the output. See further details below. An example output is: show interfaces extensive | match policer Policer: Input: __default_arp_policer__ <<< incorrect if user ARP Policer was applied on an AE interface and the default ARP Policer is displayed Policer: Input: jtac-arp-ae5.317-inet-arp <<< correct if user ARP Policer was applied on an AE interface For all platforms, except SRX Series: This issue affects Juniper Networks Junos OS: All versions 5.6R1 and all later versions prior to 18.4 versions prior to 18.4R2-S9, 18.4R3-S9 with the exception of 15.1 versions 15.1R7-S10 and later versions; 19.4 versions prior to 19.4R3-S3; 20.1 versions prior to 20.1R3; 20.2 versions prior to 20.2R3-S2; 20.3 version 20.3R1 and later versions; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2; This issue does not affect Juniper Networks Junos OS versions prior to 5.6R1. On SRX Series this issue affects Juniper Networks Junos OS: 18.4 versions prior to 18.4R2-S9, 18.4R3-S9; 19.4 versions prior to 19.4R3-S4; 20.1 versions prior to 20.1R3; 20.2 versions prior to 20.2R3-S2; 20.3 version 20.3R1 and later versions; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2. This issue does not affect 18.4 versions prior to 18.4R1 on SRX Series. This issue does not affect Junos OS Evolved.
Fixes

Solution

The following software releases have been updated to resolve this specific issue: For all platforms, except SRX Series, using Junos OS 15.1R7-S10, 18.4R2-S9, 18.4R3-S9, 19.4R3-S4, 20.1R3, 20.2R3-S2, 20.4R3, 21.1R2, 21.2R1, and all subsequent releases. On SRX series using Junos OS 18.4R2-S9, 18.4R3-S9, 19.4R3-S4. 20.1R3, 20.4R3, 21.1R2, 21.2R1, and all subsequent releases.


Workaround

There is no workaround for this issue. If affected by this issue, to recover from its impact, restart the firewall process to update the ARP Policer on the AE interface unit(s). From the CLI issue: cli> restart firewall Note: no side effects on firewall restart shall be seen when issuing this command.

References
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2024-09-17T03:48:59.800Z

Reserved: 2020-10-27T00:00:00

Link: CVE-2021-0289

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-07-15T20:15:10.563

Modified: 2024-11-21T05:42:24.760

Link: CVE-2021-0289

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses