Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing

Summary

An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network access to cause information disclosure and a denial of service via a malicious DHCP reply.

Remediation

1. Inventory every Juniper Networks Session Smart Router deployment, including staging.
2. Upgrade Juniper Networks Session Smart Router to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://supportportal.juniper.net/JSA112183