Vulnerability identifier: #VU94332

Vulnerability risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39556

CWE-ID: CWE-121

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Junos OS Evolved
Operating systems & Components / Operating system
Juniper Junos OS
Operating systems & Components / Operating system

Vendor: Juniper Networks, Inc.

Description

The vulnerability allows a local privileged user to execute arbitrary code.

A Stack-Based Buffer Overflow vulnerability in Juniper Networks Junos OS and Juniper Networks Junos OS Evolved may allow a local, low-privileged attacker with access to the CLI the ability to load a malicious certificate file, leading to a limited Denial of Service (DoS) or privileged code execution.

By exploiting the 'set security certificates' command with a crafted certificate file, a malicious attacker with access to the CLI could cause a crash of the command management daemon (mgd), limited to the local user's command interpreter, or potentially trigger a stack-based buffer overflow.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Junos OS Evolved: 22.1-EVO - 22.1R3-S4-EVO, 22.1R3-S5-EVO, 22.4R1-EVO - 22.4R3-EVO, 22.4R2-S2-EVO, 22.4R3-S1-EVO, 21.4R1-EVO - 21.4R3-S5-EVO, 21.4R3-S6-EVO, 22.3R1-EVO - 22.3R3-S1-EVO, 22.3R3-S2-EVO, 22.2-EVO - 22.2R3-S3-EVO, 21.2-EVO - 21.2R3-S6-EVO, 21.2R3-S7-EVO, 23.2R1-EVO - 23.2R1-S1-EVO, 23.2R1-S2-EVO

Juniper Junos OS: 22.1R1 - 22.1R3-S4, 22.1R3-J1, 22.1R3-S5 - 22.1R3-S5.3, 22.2R1 - 22.2R3-S2, 22.2R3-S3, 22.3R1 - 22.3R3-S1, 22.3R3-S2, 22.4R1 - 22.4R2-S2, 22.4R3-S1, 21.4R1 - 21.4R3-S5, 21.4R3-S6, 21.2R1 - 21.2R3-S6, 21.2R3-S7, 23.2R1 - 23.2R1-S1, 23.2R1-S2, 23.2R2-S1

---

External links
http://supportportal.juniper.net/JSA83016

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.