CVE-2022-22175 : What You Need to Know

An Improper Locking vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series and SRX Series allows an unauthenticated networked attacker to cause a flowprocessing daemon (flowd) crash, resulting in a Denial of Service (DoS) attack. This issue affects multiple versions of Junos OS.

Understanding CVE-2022-22175

This CVE describes a vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series and SRX Series, leading to a flowd crash and potential DoS attacks.

What is CVE-2022-22175?

A vulnerability in the SIP ALG feature of Junos OS can be exploited by an unauthenticated attacker to crash the flowd daemon, causing a DoS condition. The issue occurs when specific SIP messages are processed while the SIP ALG is enabled.

The Impact of CVE-2022-22175

The vulnerability carries a High severity base score of 7.5 according to CVSS v3.1 metrics. It has a low attack complexity and affects the availability of the system without impacting confidentiality or integrity.

Technical Details of CVE-2022-22175

Vulnerability Description

The vulnerability allows an unauthenticated networked attacker to crash the flowd daemon, leading to a sustained DoS condition on affected Junos OS versions.

Affected Systems and Versions

MX Series, SRX Series
Junos OS versions: 20.4 versions prior to 20.4R3-S1; 21.1 versions prior to 21.1R2-S2, 21.1R3; 21.2 versions prior to 21.2R1-S2, 21.2R2; 21.3 versions prior to 21.3R1-S1, 21.3R2

Exploitation Mechanism

An unauthenticated networked attacker can exploit the vulnerability by sending specific SIP messages while the SIP ALG is enabled, causing a flowd crash and DoS attack.

Mitigation and Prevention

Immediate Steps to Take

Juniper Networks recommends updating to the following software releases to address the issue: 20.4R3-S1, 21.1R2-S2, 21.1R3, 21.2R1-S2, 21.2R2, 21.3R1-S1, 21.3R2, 21.4R1, and all subsequent releases.

Long-Term Security Practices

Regularly monitor security advisories and update Junos OS installations promptly to stay protected against known vulnerabilities.

Patching and Updates

Apply patches and updates provided by Juniper Networks to mitigate the risk of DoS attacks related to the SIP ALG vulnerability.