CVE-2020-1632 vulnerability in Juniper Networks Products
Published on April 15, 2020
Junos OS and Junos OS Evolved: Invalid BGP UPDATE sent to peer device may cause BGP session to terminate.
In a certain condition, receipt of a specific BGP UPDATE message might cause Juniper Networks Junos OS and Junos OS Evolved devices to advertise an invalid BGP UPDATE message to other peers, causing the other peers to terminate the established BGP session, creating a Denial of Service (DoS) condition. For example, Router A sends a specific BGP UPDATE to Router B, causing Router B to send an invalid BGP UPDATE message to Router C, resulting in termination of the BGP session between Router B and Router C. This issue might occur when there is at least a single BGP session established on the device that does not support 4 Byte AS extension (RFC 4893). Repeated receipt of the same BGP UPDATE can result in an extended DoS condition. This issue affects Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S6; 16.2 versions prior to 16.2R2-S11; 17.1 versions prior to 17.1R2-S11, 17.1R3-S2; 17.2 versions prior to 17.2R1-S9, 17.2R2-S8, 17.2R3-S3; 17.2X75 versions prior to 17.2X75-D105, 17.2X75-D110, 17.2X75-D44; 17.3 versions prior to 17.3R2-S5, 17.3R3-S7; 17.4 versions prior to 17.4R2-S8, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R2-S6, 18.2R3-S2; 18.2X75 versions prior to 18.2X75-D12, 18.2X75-D33, 18.2X75-D411, 18.2X75-D420, 18.2X75-D51, 18.2X75-D60; 18.3 versions prior to 18.3R1-S6, 18.3R2-S3, 18.3R3; 18.4 versions prior to 18.4R1-S5, 18.4R3; 18.4 version 18.4R2 and later versions; 19.1 versions prior to 19.1R1-S3, 19.1R2; 19.2 versions prior to 19.2R1-S2, 19.2R2. This issue does not affect Juniper Networks Junos OS prior to 16.1R1. This issue affects Juniper Networks Junos OS Evolved prior to 19.2R2-EVO.
Vulnerability Analysis
CVE-2020-1632 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
Improper Handling of Exceptional Conditions
The software does not handle or incorrectly handles an exceptional condition.
Products Associated with CVE-2020-1632
Want to know whenever a new CVE is published for Juniper Networks products? stack.watch will email you.
Affected Versions
Juniper Networks Junos OS:- Version 16.1 and below 16.1R7-S6 is affected.
- Version 16.2 and below 16.2R2-S11 is affected.
- Version 17.1 and below 17.1R2-S11, 17.1R3-S2 is affected.
- Version 17.2 and below 17.2R1-S9, 17.2R2-S8, 17.2R3-S3 is affected.
- Version 17.2X75 and below 17.2X75-D105, 17.2X75-D110, 17.2X75-D44 is affected.
- Version 17.3 and below 17.3R2-S5, 17.3R3-S7 is affected.
- Version 17.4 and below 17.4R2-S8, 17.4R3 is affected.
- Version 18.1 and below 18.1R3-S8 is affected.
- Version 18.2 and below 18.2R2-S6, 18.2R3-S2 is affected.
- Version 18.2X75 and below 18.2X75-D12, 18.2X75-D33, 18.2X75-D411, 18.2X75-D420, 18.2X75-D51, 18.2X75-D60 is affected.
- Version 18.3 and below 18.3R1-S6, 18.3R2-S3, 18.3R3 is affected.
- Version 18.4 and below 18.4R1-S5, 18.4R3 is affected.
- Version 19.1 and below 19.1R1-S3, 19.1R2 is affected.
- Version 19.2 and below 19.2R1-S2, 19.2R2 is affected.
- Version unspecified and below 19.2R2-EVO is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.