An improper check for unusual or exceptional conditions vulnerability in Juniper Networks MX Series platforms with Trio-based MPC (Modular Port Concentrator) deployed in (Ethernet VPN) EVPN-(Virtual Extensible LAN) VXLAN configuration, may allow an attacker sending specific Layer 2 traffic to cause Distributed Denial of Service (DDoS) protection to trigger unexpectedly, resulting in traffic impact. Continued receipt and processing of this specific Layer 2 frames will sustain the Denial of Service (DoS) condition. An indication of compromise is to check DDOS LACP violations: user@device> show ddos-protection protocols statistics brief | match lacp This issue only affects the MX Series platforms with Trio-based MPC. No other products or platforms are affected. This issue affects: Juniper Networks Junos OS on MX Series: 15.1 versions prior to 15.1R7-S9; 17.3 versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R3-S4; 18.1 versions prior to 18.1R3-S12; 18.2 versions prior to 18.2R2-S8, 18.2R3-S8; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8, 18.4R2-S7, 18.4R3-S7; 19.1 versions prior to 19.1R3-S4; 19.2 versions prior to 19.2R1-S6; 19.3 versions prior to 19.3R3-S2; 19.4 versions prior to 19.4R2-S4, 19.4R3-S2; 20.1 versions prior to 20.1R2, 20.1R3; 20.2 versions prior to 20.2R2-S1, 20.2R3; 20.3 versions prior to 20.3R1-S1, 20.3R2;

• https://kb.juniper.net/JSA11123
• https://kb.juniper.net/JSA11123

• Juniper » Mx104 » Version: N/A
  cpe:2.3:h:juniper:mx104:-
• Juniper » Mx10 » Version: N/A
  cpe:2.3:h:juniper:mx10:-
• Juniper » Mx150 » Version: N/A
  cpe:2.3:h:juniper:mx150:-
• Juniper » Mx204 » Version: N/A
  cpe:2.3:h:juniper:mx204:-
• Juniper » Mx240 » Version: N/A
  cpe:2.3:h:juniper:mx240:-
• Juniper » Mx40 » Version: N/A
  cpe:2.3:h:juniper:mx40:-
• Juniper » Mx480 » Version: N/A
  cpe:2.3:h:juniper:mx480:-
• Juniper » Mx5 » Version: N/A
  cpe:2.3:h:juniper:mx5:-
• Juniper » Mx80 » Version: N/A
  cpe:2.3:h:juniper:mx80:-
• Juniper » Mx960 » Version: N/A
  cpe:2.3:h:juniper:mx960:-
• Juniper » Junos » Version: 15.1
  cpe:2.3:o:juniper:junos:15.1
• Juniper » Junos » Version: 17.3
  cpe:2.3:o:juniper:junos:17.3
• Juniper » Junos » Version: 17.4
  cpe:2.3:o:juniper:junos:17.4
• Juniper » Junos » Version: 18.1
  cpe:2.3:o:juniper:junos:18.1
• Juniper » Junos » Version: 18.2
  cpe:2.3:o:juniper:junos:18.2
• Juniper » Junos » Version: 18.3
  cpe:2.3:o:juniper:junos:18.3
• Juniper » Junos » Version: 18.4
  cpe:2.3:o:juniper:junos:18.4
• Juniper » Junos » Version: 19.1
  cpe:2.3:o:juniper:junos:19.1
• Juniper » Junos » Version: 19.2
  cpe:2.3:o:juniper:junos:19.2
• Juniper » Junos » Version: 19.3
  cpe:2.3:o:juniper:junos:19.3
• Juniper » Junos » Version: 19.4
  cpe:2.3:o:juniper:junos:19.4
• Juniper » Junos » Version: 20.1
  cpe:2.3:o:juniper:junos:20.1
• Juniper » Junos » Version: 20.2
  cpe:2.3:o:juniper:junos:20.2
• Juniper » Junos » Version: 20.3
  cpe:2.3:o:juniper:junos:20.3