CVE-2021-0285 : What You Need to Know

An uncontrolled resource consumption vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series switches allows an attacker to cause Interchassis Control Protocol (ICCP) interruptions, leading to an unstable control connection between Multi-Chassis Link Aggregation Group (MC-LAG) nodes, potentially resulting in a Denial of Service (DoS) condition.

Understanding CVE-2021-0285

This CVE involves a vulnerability in Junos OS on specified Juniper Networks devices that could lead to network interruptions and service impact.

What is CVE-2021-0285?

CVE-2021-0285 is a resource consumption vulnerability in Juniper Networks Junos OS, affecting QFX5000 Series and EX4600 Series switches. The flaw allows an attacker to disrupt ICCP, impacting MC-LAG nodes and potentially causing a DoS condition.

The Impact of CVE-2021-0285

Exploiting this vulnerability could lead to network instability, interruption of the control connection between MC-LAG nodes, and ultimately, a DoS condition impacting traffic.

Technical Details of CVE-2021-0285

This section provides detailed technical insights on the vulnerability.

Vulnerability Description

The vulnerability allows an attacker to send large amounts of legitimate traffic, causing ICCP interruptions and potential service disruptions.

Affected Systems and Versions

Junos OS versions prior to 15.1R7-S9, 17.3R3-S11, 17.4R2-S13, 17.4R3-S5, 18.3R3-S5, 18.4R2-S8, 18.4R3-S7, 19.1R3-S5, 19.2R1-S6, 19.2R3-S2, 19.3R2-S6, 19.3R3-S2, 19.4R1-S4, 19.4R2-S4, 19.4R3-S2, 20.1R2-S2, 20.1R3, 20.2R2-S3, 20.2R3, 20.3R2, 20.4R1-S1, 20.4R2 are affected.

Exploitation Mechanism

There is no known exploitation of this vulnerability in the wild, as reported by Juniper SIRT.

Mitigation and Prevention

Protecting your systems from CVE-2021-0285 involves taking critical security measures.

Immediate Steps to Take

While no complete workaround exists, mitigate the risk by filtering undesirable traffic using firewall filters and policers.

Long-Term Security Practices

Regularly update Junos OS to the patched versions to mitigate this vulnerability and enhance overall security.

Patching and Updates

Ensure that your Junos OS is updated to versions 15.1R7-S9, 17.3R3-S11, 17.4R2-S13, 17.4R3-S5, 18.1R3-S13, 18.2R3-S8, 18.3R3-S5, 18.4R2-S8, 18.4R3-S7, 19.1R3-S5, 19.2R1-S6, 19.2R3-S2, 19.3R2-S6, 19.3R3-S2, 19.4R1-S4, 19.4R2-S4, 19.4R3-S2, 20.1R2-S2, 20.1R3, 20.2R2-S3, 20.2R3, 20.3R2, 20.4R1-S1, 20.4R2, 21.1R1, or any subsequent releases.