Description
When user-defined ARP Policer is configured and applied on one or more Aggregated Ethernet (AE) interface units, a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability between the Device Control Daemon (DCD) and firewall process (dfwd) daemons of Juniper Networks Junos OS allows an attacker to bypass the user-defined ARP Policer. In this particular case the User ARP policer is replaced with default ARP policer. To review the desired ARP Policers and actual state one can run the command "show interfaces <> extensive" and review the output. See further details below. An example output is: show interfaces extensive | match policer Policer: Input: __default_arp_policer__ <<< incorrect if user ARP Policer was applied on an AE interface and the default ARP Policer is displayed Policer: Input: jtac-arp-ae5.317-inet-arp <<< correct if user ARP Policer was applied on an AE interface For all platforms, except SRX Series: This issue affects Juniper Networks Junos OS: All versions 5.6R1 and all later versions prior to 18.4 versions prior to 18.4R2-S9, 18.4R3-S9 with the exception of 15.1 versions 15.1R7-S10 and later versions; 19.4 versions prior to 19.4R3-S3; 20.1 versions prior to 20.1R3; 20.2 versions prior to 20.2R3-S2; 20.3 version 20.3R1 and later versions; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2; This issue does not affect Juniper Networks Junos OS versions prior to 5.6R1. On SRX Series this issue affects Juniper Networks Junos OS: 18.4 versions prior to 18.4R2-S9, 18.4R3-S9; 19.4 versions prior to 19.4R3-S4; 20.1 versions prior to 20.1R3; 20.2 versions prior to 20.2R3-S2; 20.3 version 20.3R1 and later versions; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2. This issue does not affect 18.4 versions prior to 18.4R1 on SRX Series. This issue does not affect Junos OS Evolved.
Published: 2021-07-15
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: For all platforms, except SRX Series, using Junos OS 15.1R7-S10, 18.4R2-S9, 18.4R3-S9, 19.4R3-S4, 20.1R3, 20.2R3-S2, 20.4R3, 21.1R2, 21.2R1, and all subsequent releases. On SRX series using Junos OS 18.4R2-S9, 18.4R3-S9, 19.4R3-S4. 20.1R3, 20.4R3, 21.1R2, 21.2R1, and all subsequent releases.


Vendor Workaround

There is no workaround for this issue. If affected by this issue, to recover from its impact, restart the firewall process to update the ARP Policer on the AE interface unit(s). From the CLI issue: cli> restart firewall Note: no side effects on firewall restart shall be seen when issuing this command.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2021-2908 When user-defined ARP Policer is configured and applied on one or more Aggregated Ethernet (AE) interface units, a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability between the Device Control Daemon (DCD) and firewall process (dfwd) daemons of Juniper Networks Junos OS allows an attacker to bypass the user-defined ARP Policer. In this particular case the User ARP policer is replaced with default ARP policer. To review the desired ARP Policers and actual state one can run the command "show interfaces <> extensive" and review the output. See further details below. An example output is: show interfaces extensive | match policer Policer: Input: __default_arp_policer__ <<< incorrect if user ARP Policer was applied on an AE interface and the default ARP Policer is displayed Policer: Input: jtac-arp-ae5.317-inet-arp <<< correct if user ARP Policer was applied on an AE interface For all platforms, except SRX Series: This issue affects Juniper Networks Junos OS: All versions 5.6R1 and all later versions prior to 18.4 versions prior to 18.4R2-S9, 18.4R3-S9 with the exception of 15.1 versions 15.1R7-S10 and later versions; 19.4 versions prior to 19.4R3-S3; 20.1 versions prior to 20.1R3; 20.2 versions prior to 20.2R3-S2; 20.3 version 20.3R1 and later versions; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2; This issue does not affect Juniper Networks Junos OS versions prior to 5.6R1. On SRX Series this issue affects Juniper Networks Junos OS: 18.4 versions prior to 18.4R2-S9, 18.4R3-S9; 19.4 versions prior to 19.4R3-S4; 20.1 versions prior to 20.1R3; 20.2 versions prior to 20.2R3-S2; 20.3 version 20.3R1 and later versions; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2. This issue does not affect 18.4 versions prior to 18.4R1 on SRX Series. This issue does not affect Junos OS Evolved.
References
History

No history.

Subscriptions

Juniper Acx1000 Acx1100 Acx2000 Acx2100 Acx2200 Acx4000 Acx500 Acx5000 Acx5048 Acx5096 Acx5400 Acx5448 Acx5800 Acx6300 Acx6360 Acx710 Atp400 Atp700 Csrx Ctp150 Ctp2008 Ctp2024 Ctp2056 Dx Ex2200 Ex2200-c Ex2200-vc Ex2300 Ex2300-c Ex2300m Ex3200 Ex3300 Ex3300-vc Ex3400 Ex4200 Ex4200-vc Ex4300 Ex4300-24p Ex4300-24p-s Ex4300-24t Ex4300-24t-s Ex4300-32f Ex4300-32f-dc Ex4300-32f-s Ex4300-48mp Ex4300-48mp-s Ex4300-48p Ex4300-48p-s Ex4300-48t Ex4300-48t-afi Ex4300-48t-dc Ex4300-48t-dc-afi Ex4300-48t-s Ex4300-48tafi Ex4300-48tdc Ex4300-48tdc-afi Ex4300-mp Ex4300-vc Ex4300m Ex4400 Ex4500 Ex4500-vc Ex4550 Ex4550-vc Ex4550\/vc Ex4600 Ex4600-vc Ex4650 Ex6200 Ex6210 Ex8200 Ex8200-vc Ex8208 Ex8216 Ex9200 Ex9204 Ex9208 Ex9214 Ex9250 Ex9251 Ex9253 Ex Rps Fips Infranet Controller 6500 Fips Secure Access 4000 Fips Secure Access 4500 Fips Secure Access 6000 Fips Secure Access 6500 Gfx3600 Idp250 Idp75 Idp800 Idp8200 Infranet Controller 4000 Infranet Controller 4500 Infranet Controller 6000 Infranet Controller 6500 Jatp Junos Junos Space Ja1500 Appliance Junos Space Ja2500 Appliance Ln1000 Ln2600 M10i M120 M320 M7i Mag2600 Gateway Mag4610 Gateway Mag6610 Gateway Mag6611 Gateway Mx Mx10 Mx10000 Mx10003 Mx10008 Mx10016 Mx104 Mx150 Mx2008 Mx2010 Mx2020 Mx204 Mx240 Mx40 Mx480 Mx5 Mx80 Mx960 Netscreen-5200 Netscreen-5400 Netscreen-5gt Netscreen-idp Netscreen-idp 10 Netscreen-idp 100 Netscreen-idp 1000 Netscreen-idp 500 Nfx Nfx150 Nfx250 Nfx350 Nsm3000 Nsmexpress Ocx1100 Ptx1000 Ptx1000-72q Ptx10000 Ptx10001 Ptx10001-36mr Ptx100016 Ptx10002 Ptx10002-60c Ptx10003 Ptx10003 160c Ptx10003 80c Ptx10003 81cd Ptx10004 Ptx10008 Ptx10016 Ptx3000 Ptx5000 Qfx10000 Qfx10002 Qfx10002-32q Qfx10002-60c Qfx10002-72q Qfx10008 Qfx10016 Qfx3000-g Qfx3000-m Qfx3008-i Qfx3100 Qfx3500 Qfx3600 Qfx3600-i Qfx5100 Qfx5100-96s Qfx5110 Qfx5120 Qfx5130 Qfx5200 Qfx5200-32c Qfx5200-48y Qfx5210 Qfx5210-64c Qfx5220 Router M10 Router M16 Router M20 Router M40 Router M5 Secure Access 2000 Secure Access 2500 Secure Access 4000 Secure Access 4500 Secure Access 6000 Secure Access 6500 Secure Access 700 Srx100 Srx110 Srx1400 Srx1500 Srx210 Srx220 Srx240 Srx240h2 Srx300 Srx320 Srx340 Srx3400 Srx345 Srx3600 Srx380 Srx4000 Srx4100 Srx4200 Srx4600 Srx5000 Srx5400 Srx550 Srx550 Hm Srx550m Srx5600 Srx5800 Srx650 T1600 T320 T4000 T640 Xre200
cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2024-09-17T03:48:59.800Z

Reserved: 2020-10-27T00:00:00.000Z

Link: CVE-2021-0289

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-07-15T20:15:10.563

Modified: 2024-11-21T05:42:24.760

Link: CVE-2021-0289

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses