Vulnerability Note VU#409555

Juniper routers running JUNOS have a vulnerability in which specially-crafted MPLS packets can cause normal operation of affected routers to be severely disrupted.

According to Juniper's security bulletin PSN-2005-02-004:

    When an M-series or T-series Juniper routing platform receives
    certain MPLS packets, the packets are immediately delivered to the
    Routing Engine (RE) for further processing.  This occurs even if
    packets are received on an interface which is not enabled for MPLS
    processing, or if the router is not configured to process MPLS
    packets at all.  Furthermore, these MPLS packets are delivered without
    any further processing by the hardware, thus bypassing all
    attempts at limiting the number of, or otherwise filtering, the
    packets.  A large stream of these MPLS packets can overload
    internal communication paths and interfere with the timely
    processing of other packets.


It is important to note an attacker does not need to directly connected to a router in order to exploit this vulnerability. According to PSN-2005-02-004:

    This vulnerability can be exploited by an attacker directly
    attached to a Juniper Networks M-series or T-series routing
    platform, even if the interface to which the attacker is attached
    is not enabled for MPLS.  An attacker not directly attached to the
    routing platform can exploit this vulnerability on transit Label
    Switch Routers within an Internet Service Provider's MPLS-enabled
    core network.  

Please see the Juniper Vendor statement document for additional configuration changes that may provide partial mitigation of one potential attack vector.

A remote, unauthenticated attacker may cause severe operational disruption to affected Juniper routers. Affected routers will suffer an effective denial of routing service when this vulnerability is exploited.

Please see the vendor statement with relevant patches. Users registered at Juniper's support site should visit https://www.juniper.net/alerts/viewalert.jsp?txtAlertNumber=PSN-2005-02-004&actionBtn=Search
This vulnerability is present in all JUNOS software releases built prior to January 6, 2005.

According to Juniper, it is not possible to use network filters to protect vulnerable routers. Vulnerable routers must be updated in order to completely mitigate this vulnerability.