Overview
The vulnerability identified as CVE-2024-21606 is a critical issue that affects Juniper Networks Junos OS on SRX Series. This vulnerability, due to a Double Free issue, potentially allows an unauthenticated attacker to cause a Denial of Service (DoS) attack, posing a serious threat to businesses and organizations that rely on these systems for their operations.
Vulnerability Summary
CVE ID: CVE-2024-21606
Severity: High (7.5)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage, leading to Denial of Service
Affected Products
A new way to communicate
Ameeba Chat is built on encrypted identity, not personal profiles.
Message, call, share files, and coordinate with identities kept separate.
- • Encrypted identity
- • Ameeba Chat authenticates access
- • Aliases and categories
- • End-to-end encrypted chat, calls, and files
- • Secure notes for sensitive information
Private communication, rethought.
Product | Affected Versions
Junos OS on SRX Series | All versions earlier than 20.4R3-S8
Junos OS on SRX Series | 21.2 versions earlier than 21.2R3-S6
Junos OS on SRX Series | 21.3 versions earlier than 21.3R3-S5
Junos OS on SRX Series | 21.4 versions earlier than 21.4R3-S5
Junos OS on SRX Series | 22.1 versions earlier than 22.1R3-S3
Junos OS on SRX Series | 22.2 versions earlier than 22.2R3-S3
Junos OS on SRX Series | 22.3 versions earlier than 22.3R3-S1
Junos OS on SRX Series | 22.4 versions earlier than 22.4R2-S2, 22.4R3
How the Exploit Works
The exploit works by taking advantage of a Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX Series. In a remote access VPN scenario, if a “tcp-encap-profile” is configured and a sequence of specific packets is received, a flowd crash and restart will be observed, leading to a Denial of Service.
Conceptual Example Code
While the exact details of the exploit are not provided, a conceptual example might involve sending a specific sequence of packets to a vulnerable endpoint. It might look something like this:
import socket
def send_malicious_packets(target_ip, target_port):
# Establish a connection
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((target_ip, target_port))
# Send a sequence of specific packets
for packet in malicious_packet_sequence:
s.send(packet)
# Close the connection
s.close()
# Replace with the target IP and port
send_malicious_packets('192.0.2.0', 1234)