CVE-2020-1648 : Security Advisory and Response

On Jul 8, 2020, a vulnerability affecting Juniper Networks Junos OS and Junos OS Evolved versions was published, potentially leading to a routing process daemon crash and DoS condition. Find details below.

Understanding CVE-2020-1648

This CVE describes a specific vulnerability in Juniper Networks Junos OS and Junos OS Evolved that can cause a crash in the routing process daemon (RPD) and result in a Denial of Service (DoS) situation.

What is CVE-2020-1648?

This vulnerability in Juniper Networks Junos OS and Junos OS Evolved devices is triggered by processing a specific BGP packet, potentially causing a crash and restart of the RPD, even prior to establishing a BGP session, leading to a prolonged DoS.

The Impact of CVE-2020-1648

The impact of this CVE is rated as high severity due to its potential to cause a crash in the RPD and initiate a Denial of Service condition on affected devices.

Technical Details of CVE-2020-1648

This section dives into the technical aspects of CVE-2020-1648.

Vulnerability Description

The vulnerability can lead to a crash in the routing process daemon (RPD) of affected Juniper Networks Junos OS and Junos OS Evolved devices when processing a specific BGP packet.

Affected Systems and Versions

Juniper Networks Junos OS: Versions from 18.2X75-D50.8, 18.2X75-D60 onwards but before 18.2X75-D52.8, 18.2X75-D53, 18.2X75-D60.2, 18.2X75-D65.1, 18.2X75-D70; 19.4 versions 19.4R1, 19.4R1-S1; 20.1 versions earlier than 20.1R1-S2, 20.1R2.
Juniper Networks Junos OS Evolved: 19.4-EVO versions prior to 19.4R2-S2-EVO; 20.1-EVO versions before 20.1R2-EVO.

Exploitation Mechanism

The vulnerability is triggered by processing a specific BGP packet, potentially leading to a crash in the RPD and a subsequent Denial of Service situation.

Mitigation and Prevention

In this section, find mitigation and preventive measures for CVE-2020-1648.

Immediate Steps to Take

Update to the following software versions: Junos OS - 18.2X75-D52.8, 18.2X75-D53, 18.2X75-D60.2, 18.2X75-D65.1, 18.2X75-D70, 19.4R1-S2, 19.4R2, 20.1R1-S2, 20.1R2, 20.2R1, and later. Junos OS Evolved - 19.4R2-S2-EVO, 20.1R2-EVO, 20.2R1-EVO, and subsequent releases.

Long-Term Security Practices

Regularly update software to the latest versions to patch known vulnerabilities.
Implement network monitoring to detect and respond to unusual BGP packet processing behaviors.

Patching and Updates

Keep systems up to date by applying the latest software patches and updates provided by Juniper Networks.