Vulnerability Description
An Improper Handling of Unexpected Data Type vulnerability in IPv6 firewall filter processing of Juniper Networks Junos OS on the ACX Series devices will prevent a firewall filter with the term 'from next-header ah' from being properly installed in the packet forwarding engine (PFE). There is no immediate indication of an incomplete firewall filter commit shown at the CLI, which could allow an attacker to send valid packets to or through the device that were explicitly intended to be dropped. An indication that the filter was not installed can be identified with the following logs: fpc0 ACX_DFW_CFG_FAILED: ACX Error (dfw):dnx_dfw_rule_prepare : Config failed: Unsupported Ip-protocol 51 in the filter lo0.0-inet6-i fpc0 ACX_DFW_CFG_FAILED: ACX Error (dfw):dnx_dfw_rule_prepare : Please detach the filter, remove unsupported match and re-attach fpc0 ACX_DFW_CFG_FAILED: ACX Error (dfw):dnx_dfw_process_rule : Status:104 dnx_dfw_rule_prepare failed fpc0 ACX_DFW_CFG_FAILED: ACX Error (dfw):dnx_dfw_process_filter : Status:104 dnx_dfw_process_rule failed fpc0 ACX_DFW_CFG_FAILED: ACX Error (dfw):dnx_dfw_update_filter_in_hw : Status:104 Could not process filter(lo0.0-inet6-i) for rule expansion Unsupported match, action present. fpc0 ACX_DFW_CFG_FAILED: ACX Error (dfw):dnx_dfw_create_hw_instance : Status:104 Could not program dfw(lo0.0-inet6-i) type(IFP_DFLT_INET6_Lo0_FILTER)! [104] fpc0 ACX_DFW_CFG_FAILED: ACX Error (dfw):dnx_dfw_bind_shim : [104] Could not create dfw(lo0.0-inet6-i) type(IFP_DFLT_INET6_Lo0_FILTER) fpc0 ACX_DFW_CFG_FAILED: ACX Error (dfw):dnx_dfw_update_resolve : [100] Failed to bind filter(3) to bind point fpc0 ACX_DFW_CFG_FAILED: ACX Error (dfw):dnx_dfw_change_end : dnx_dfw_update_resolve (resolve type) failed This issue affects Juniper Networks Junos OS on ACX Series: All versions prior to 20.2R3-S7; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S3; 21.2 versions prior to 21.2R3-S4; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R3; 22.1 versions prior to 22.1R2.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Juniper | Junos | < 20.2 |
| Juniper | Acx1000 | - |
| Juniper | Acx1100 | - |
| Juniper | Acx2000 | - |
| Juniper | Acx2100 | - |
| Juniper | Acx2200 | - |
| Juniper | Acx4000 | - |
| Juniper | Acx500 | - |
| Juniper | Acx5000 | - |
| Juniper | Acx5048 | - |
| Juniper | Acx5096 | - |
| Juniper | Acx5400 | - |
| Juniper | Acx5448 | - |
| Juniper | Acx5800 | - |
| Juniper | Acx6300 | - |
| Juniper | Acx6360 | - |
| Juniper | Acx710 | - |
| Juniper | Acx7100-32C | - |
| Juniper | Acx7100-48L | - |
| Juniper | Acx7509 | - |
Related Weaknesses (CWE)
References
- https://supportportal.juniper.net/JSA70586Vendor Advisory
- https://supportportal.juniper.net/JSA70586Vendor Advisory
FAQ
What is CVE-2023-28961?
CVE-2023-28961 is a vulnerability with a CVSS score of 5.8 (MEDIUM). An Improper Handling of Unexpected Data Type vulnerability in IPv6 firewall filter processing of Juniper Networks Junos OS on the ACX Series devices will prevent a firewall filter with the term 'from ...
How severe is CVE-2023-28961?
CVE-2023-28961 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-28961?
Check the references section above for vendor advisories and patch information. Affected products include: Juniper Junos, Juniper Acx1000, Juniper Acx1100, Juniper Acx2000, Juniper Acx2100.