SB2019011503 - Multiple vulnerabilities in Juniper ATP
Published: January 15, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 secuirty vulnerabilities.
1) Command Injection (CVE-ID: CVE-2017-11610)
The vulnerability allows a remote authenticated attacker to execute arbitrary commands on the target system.
The vulnerability exists in the XML-RPC server due to insufficient validation of user-supplied input. A remote attacker can execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
2) Cross-site scripting (CVE-ID: CVE-2019-0018)
The disclosed vulnerability allows a remote authenticated attacker to perform persistent cross-site scripting (XSS) attacks.
The vulnerability exists in the file upload menu of Juniper ATP due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
3) Cross-site scripting (CVE-ID: CVE-2019-0023)
The disclosed vulnerability allows a remote authenticated attacker to perform persistent cross-site scripting (XSS) attacks.
The vulnerability exists in the Golden VM menu of Juniper ATP due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
4) Cross-site scripting (CVE-ID: CVE-2019-0025)
The disclosed vulnerability allows a remote authenticated attacker to perform persistent cross-site scripting (XSS) attacks.
The vulnerability exists in RADIUS configuration menu of Juniper ATP due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
5) Cross-site scripting (CVE-ID: CVE-2019-0026)
The disclosed vulnerability allows a remote authenticated attacker to perform persistent cross-site scripting (XSS) attacks.
The vulnerability exists in the Zone configuration of Juniper ATP due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
6) Cross-site scripting (CVE-ID: CVE-2019-0024)
The disclosed vulnerability allows a remote authenticated attacker to perform persistent cross-site scripting (XSS) attacks.
The vulnerability exists in the Email Collectors menu of Juniper ATP due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
7) Cross-site scripting (CVE-ID: CVE-2019-0027)
The disclosed vulnerability allows a remote authenticated attacker to perform persistent cross-site scripting (XSS) attacks.
The vulnerability exists in the Snort Rules configuration of Juniper ATP due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
8) Information disclosure (CVE-ID: CVE-2019-0030)
The disclosed vulnerability allows a local high-privileged attacker to obtain potentially sensitive information.
The vulnerability exists due to Juniper ATP uses DES and a hardcoded salt for password hashing. A local attacker can trivially de-hash the password file contents and access sensitive data.
9) Information disclosure (CVE-ID: CVE-2019-0021)
The disclosed vulnerability allows a local low-privileged attacker to obtain potentially sensitive information.
The vulnerability exists due to secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text. A local attacker can view these secret information.
10) Use of hardcoded credentials (CVE-ID: CVE-2019-0020)
The disclosed vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to use of hard-coded credentials in Web Collector. A remote attacker can execute arbitrary code with elevated privileges and compromise the vulnerable system.
11) Use of hardcoded credentials (CVE-ID: CVE-2019-0022)
The disclosed vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to two hardcoded credentials are sharing the same password. A remote attacker can take control of any installation of the software and compromise the vulnerable system.
12) Privilege escalation (CVE-ID: CVE-2019-0029)
The disclosed vulnerability allows a local low-privileged attacker to gain elevated privileges.
The vulnerability exists due to Juniper ATP uses DES and a hardcoded salt for password hashing. A local attacker can to access the Splunk server and execute arbitrary code with elevated privileges.
13) Privilege escalation (CVE-ID: CVE-2019-0004)
The disclosed vulnerability allows a local low-privileged attacker to gain elevated privileges.
The vulnerability exists due to the API key and the device key are logged in a file readable by authenticated local users. A local attacker can obtain these keys to perform critical operations on the WebUI interface.
Remediation
Install update from vendor's website.