CVE-2021-0226
📋 TL;DR
This vulnerability allows attackers to cause a denial of service on Juniper Junos OS Evolved devices by sending a specific IPv6 packet that terminates established IPv6 BGP sessions. Only Junos OS Evolved devices running affected versions are vulnerable, while standard Junos OS devices are not affected.
💻 Affected Systems
- Juniper Networks Junos OS Evolved
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Sustained BGP session termination leading to complete network disruption for IPv6 traffic, potentially causing widespread routing instability and service outages.
Likely Case
Intermittent BGP session drops causing routing instability, packet loss, and degraded network performance for IPv6 traffic.
If Mitigated
Minimal impact with proper network segmentation, BGP session monitoring, and rapid detection of anomalous IPv6 traffic.
🎯 Exploit Status
Exploitation requires network access to BGP sessions and knowledge of the specific packet format. No authentication is required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 19.4R2-S3-EVO, 20.1R2-S3-EVO, 20.2R2-S1-EVO, 20.3R2-EVO or later
Vendor Advisory: https://kb.juniper.net/JSA11121
Restart Required: Yes
Instructions:
1. Check current version with 'show version'. 2. Download appropriate patch from Juniper support. 3. Apply patch using standard Junos upgrade procedures. 4. Reboot device to activate fixed version.
🔧 Temporary Workarounds
IPv6 BGP Session Filtering
allImplement ACLs or firewall rules to filter suspicious IPv6 traffic to BGP sessions
set firewall family inet6 filter BGP-FILTER term BLOCK-MALICIOUS from source-address <suspicious-ipv6>
set firewall family inet6 filter BGP-FILTER term BLOCK-MALICIOUS then discard
set protocols bgp group <group-name> import BGP-FILTER
BGP Session Monitoring
allImplement aggressive BGP session monitoring and automatic restart
set protocols bgp group <group-name> hold-time 30
set protocols bgp group <group-name> keepalive 10
set event-options policy BGP-RESTART events bgp_neighbor_down
set event-options policy BGP-RESTART then execute-commands commands "restart bgp"
🧯 If You Can't Patch
- Implement strict IPv6 traffic filtering at network perimeter to block suspicious packets
- Consider temporarily disabling IPv6 BGP sessions if IPv4-only operation is acceptable
🔍 How to Verify
Check if Vulnerable:
Run 'show version' and check if version matches affected range. Check BGP session status with 'show bgp summary' for IPv6 sessions.Check Version:
show version | match JunosVerify Fix Applied:
After patching, verify version is updated with 'show version'. Monitor BGP sessions with 'show bgp neighbor' for stability.📡 Detection & Monitoring
Log Indicators:
- BGP session state changes
- Unexpected BGP neighbor down events
- IPv6 packet drops in firewall logs
Network Indicators:
- Sudden BGP session drops for IPv6 peers
- Increased BGP keepalive timeouts
- Unusual IPv6 traffic patterns to BGP ports
SIEM Query:
source="juniper-firewall" (dest_port=179 OR protocol="BGP") action="deny" OR source="juniper-bgp" event="neighbor_down"