Multiple vulnerabilities in Juniper Junos Space

Published: 2018-10-11 17:27:03 | Updated: 2018-10-11
Severity Low
Patch available YES
Number of vulnerabilities 7
CVE ID CVE-2016-10009
CVE-2016-10010
CVE-2016-10011
CVE-2016-10012
CVE-2017-15906
CVE-2018-0046
CVE-2018-0047
CVSSv3 7.5 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]
7 [CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]
4.8 [CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
6.8 [CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
5.7 [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
5.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
5.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CWE ID CWE-20
CWE-264
CWE-119
CWE-79
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Public exploit code for vulnerability #2 is available.
Vulnerable software Juniper Junos Space
Vulnerable software versions Juniper Junos Space 17.2R2
Juniper Junos Space 15.1X53-D231
Juniper Junos Space 15.1X53-D70

Show more

Vendor URL Juniper Networks, Inc.

Security Advisory

1) Improper input validation

Description

The vulnerability allows a remote attacker to execute arbitrary code on vulnerable ssh client.

The vulnerability exists due to incorrect handling of data passed to PKCS#11 module within ssh-agent. A remote attacker with control over sshd service can execute arbitrary code on vulnerable client.

Successful exploitation of this vulnerability may allow a remote attacker to execute arbitrary code on vulnerable client system but requires that client is connected to malicious SSH server.

Remediation

Update to version 18.2R1.

External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10880&cat=SIRT_1&actp=LIST

2) Privilege escalation

Description

The vulnerability allows a local user to execute arbitrary code on vulnerable system with root privileges.

The vulnerability exists due to an error in sshd in serverloop.c, which may allow a local authenticated user to execute arbitrary code with root privileges via a forwarded Unix-domain socket.

Successful exploitation of this vulnerability may allow a local user to elevate privileges.

Remediation

Update to version 18.2R1.

External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10880&cat=SIRT_1&actp=LIST

3) Information disclosure

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to an error in authfile.c, which may allow a local authenticated user to obtain host private key material.

Successful exploitation of this vulnerability may allow a local user to gain access to otherwise restricted information.

Remediation

Update to version 18.2R1.

External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10880&cat=SIRT_1&actp=LIST

4) Buffer overflow

Description

The vulnerability allows a local user to execute arbitrary code on vulnerable system with root privileges.

The vulnerability exists in sshd due to a flaw in boundary checks in the shared memory manager that may be skipped by some optimizing compilers. A local user can trigger memory corruption and execute arbitrary code with root privileges. The issue is related to m_zback and m_zlib data structures.

Successful exploitation of this vulnerability may allow a local user to elevate privileges.

Remediation

Update to version 18.2R1.

External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10880&cat=SIRT_1&actp=LIST

5) Denial of service

Description

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The weakness exists in the process_open() function due to improper prevention of write operations in read-only mode. A remote attacker can create zero-length files and cause the service to crash.

Successful exploitation of the vulnerability results in denial of service.

Remediation

Update to version 18.2R1.

External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10880&cat=SIRT_1&actp=LIST

6) Cross-site scripting

Description

The disclosed vulnerability allows a remote attacker to perform reflected cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

Update to version 18.2R1.

External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10880&cat=SIRT_1&actp=LIST

7) Cross-site scripting

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists in the UI framework used by Junos Space Security Director due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

Update to version 17.2R2.

External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10881&cat=SIRT_1&actp=LIST

Back to List