SB2017071304 - Multiple vulnerabilities in Juniper Junos
Published: July 13, 2017
Security Bulletin ID
SB2017071304
Severity
High
Patch available
YES
Number of vulnerabilities
3
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Security restrictions bypass (CVE-ID: CVE-2017-2343)
The vulnerability allows a remote attacker to gain root access to the target system.The weakness exists due to use of hard-coded authentication credentials by the Integrated User Firewall feature. A remote attacker can pass these credentials in clear text or in an encrypted format and gain control of the target system, other SRX Series devices in the same environment and Active Directory servers and services.
Successful exploitation of the vulnerability results in full control over the system.
2) Improper input validation (CVE-ID: CVE-2017-2345)
The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code.The weakness exists due to insufficient validation of user-supplied data. A remote attacker can send a specially crafted SNMP packet to the target routing engine, cause the snmpd daemon to crash or execute arbitrary code on the system.
Successful exploitation of the vulnerability may result in system compromise.
3) Authentication bypass (CVE-ID: CVE-2017-10601)
The vulnerability allows a remote attacker to bypass authentication on the target system.The weakness exists due to a specific device configuration error. A remote attacker can bypass password-based authentication and gain access to the target system.
Remediation
Install update from vendor's website.