Multiple vulnerabilities in Juniper ATP



Risk High
Patch available YES
Number of vulnerabilities 13
CVE-ID CVE-2017-11610
CVE-2019-0018
CVE-2019-0023
CVE-2019-0025
CVE-2019-0026
CVE-2019-0024
CVE-2019-0027
CVE-2019-0030
CVE-2019-0021
CVE-2019-0020
CVE-2019-0022
CVE-2019-0029
CVE-2019-0004
CWE-ID CWE-77
CWE-79
CWE-200
CWE-312
CWE-798
CWE-259
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
 Juniper ATP
Client/Desktop applications / Other client software

Vendor Juniper Networks, Inc.

Security Bulletin

This security bulletin contains information about 13 vulnerabilities.

1) Command Injection

EUVDB-ID: #VU16974

Risk: Low

CVSSv4.0: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Clear]

CVE-ID: CVE-2017-11610

CWE-ID: CWE-77 - Command injection

Exploit availability: Yes

Description

The vulnerability allows a remote authenticated attacker to execute arbitrary commands on the target system.

The vulnerability exists in the XML-RPC server due to insufficient validation of user-supplied input. A remote attacker can execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

Mitigation

Update to version 5.0.3.

Vulnerable software versions

Juniper ATP: All versions

CPE2.3 External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10918&cat=SIRT_1&actp=LIST


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.

2) Cross-site scripting

EUVDB-ID: #VU16975

Risk: Low

CVSSv4.0: 0.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-0018

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote authenticated attacker to perform persistent cross-site scripting (XSS) attacks.

The vulnerability exists in the file upload menu of Juniper ATP due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Update to version 5.0.3.

Vulnerable software versions

Juniper ATP: All versions

CPE2.3 External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10918&cat=SIRT_1&actp=LIST


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Cross-site scripting

EUVDB-ID: #VU16976

Risk: Low

CVSSv4.0: 0.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-0023

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote authenticated attacker to perform persistent cross-site scripting (XSS) attacks.

The vulnerability exists in the Golden VM menu of Juniper ATP due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Update to version 5.0.3.

Vulnerable software versions

Juniper ATP: All versions

CPE2.3 External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10918&cat=SIRT_1&actp=LIST


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Cross-site scripting

EUVDB-ID: #VU16977

Risk: Low

CVSSv4.0: 0.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-0025

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote authenticated attacker to perform persistent cross-site scripting (XSS) attacks.

The vulnerability exists in RADIUS configuration menu of Juniper ATP due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Update to version 5.0.3.

Vulnerable software versions

Juniper ATP: All versions

CPE2.3 External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10918&cat=SIRT_1&actp=LIST


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Cross-site scripting

EUVDB-ID: #VU16978

Risk: Low

CVSSv4.0: 0.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-0026

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote authenticated attacker to perform persistent cross-site scripting (XSS) attacks.

The vulnerability exists in the Zone configuration of Juniper ATP due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Update to version 5.0.3.

Vulnerable software versions

Juniper ATP: All versions

CPE2.3 External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10918&cat=SIRT_1&actp=LIST


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Cross-site scripting

EUVDB-ID: #VU16979

Risk: Low

CVSSv4.0: 0.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-0024

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote authenticated attacker to perform persistent cross-site scripting (XSS) attacks.

The vulnerability exists in the Email Collectors menu of Juniper ATP due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Update to version 5.0.3.

Vulnerable software versions

Juniper ATP: All versions

CPE2.3 External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10918&cat=SIRT_1&actp=LIST


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Cross-site scripting

EUVDB-ID: #VU16980

Risk: Low

CVSSv4.0: 0.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-0027

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote authenticated attacker to perform persistent cross-site scripting (XSS) attacks.

The vulnerability exists in the Snort Rules configuration of Juniper ATP due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Update to version 5.0.3.

Vulnerable software versions

Juniper ATP: All versions

CPE2.3 External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10918&cat=SIRT_1&actp=LIST


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Information disclosure

EUVDB-ID: #VU16981

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-0030

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The disclosed vulnerability allows a local high-privileged attacker to obtain potentially sensitive information.

The vulnerability exists due to Juniper ATP uses DES and a hardcoded salt for password hashing. A local attacker can trivially de-hash the password file contents and access sensitive data.

Mitigation

Update to version 5.0.3.

Vulnerable software versions

Juniper ATP: All versions

CPE2.3 External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10918&cat=SIRT_1&actp=LIST


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Information disclosure

EUVDB-ID: #VU16982

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-0021

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

Exploit availability: No

Description

The disclosed vulnerability allows a local low-privileged attacker to obtain potentially sensitive information.

The vulnerability exists due to secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text. A local attacker can view these secret information.

Mitigation

Update to version 5.0.4.

Vulnerable software versions

Juniper ATP: All versions

CPE2.3 External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10918&cat=SIRT_1&actp=LIST


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Use of hardcoded credentials

EUVDB-ID: #VU16983

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-0020

CWE-ID: CWE-798 - Use of Hard-coded Credentials

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use of hard-coded credentials in Web Collector. A remote attacker can execute arbitrary code with elevated privileges and compromise the vulnerable system.

Mitigation

Update to version 5.0.3.

Vulnerable software versions

Juniper ATP: All versions

CPE2.3 External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10918&cat=SIRT_1&actp=LIST


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Use of hardcoded credentials

EUVDB-ID: #VU16984

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-0022

CWE-ID: CWE-798 - Use of Hard-coded Credentials

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to two hardcoded credentials are sharing the same password. A remote attacker can take control of any installation of the software and compromise the vulnerable system.

Mitigation

Update to version 5.0.3.

Vulnerable software versions

Juniper ATP: All versions

CPE2.3 External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10918&cat=SIRT_1&actp=LIST


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Privilege escalation

EUVDB-ID: #VU16985

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-0029

CWE-ID: CWE-259 - Use of Hard-coded Password

Exploit availability: No

Description

The disclosed vulnerability allows a local low-privileged attacker to gain elevated privileges.

The vulnerability exists due to Juniper ATP uses DES and a hardcoded salt for password hashing. A local attacker can to access the Splunk server and execute arbitrary code with elevated privileges.

Mitigation

Update to version 5.0.3.

Vulnerable software versions

Juniper ATP: All versions

CPE2.3 External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10918&cat=SIRT_1&actp=LIST


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Privilege escalation

EUVDB-ID: #VU16986

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-0004

CWE-ID: CWE-259 - Use of Hard-coded Password

Exploit availability: No

Description

The disclosed vulnerability allows a local low-privileged attacker to gain elevated privileges.

The vulnerability exists due to the API key and the device key are logged in a file readable by authenticated local users. A local attacker can obtain these keys to perform critical operations on the WebUI interface.

Mitigation

Update to version 5.0.3.

Vulnerable software versions

Juniper ATP: All versions

CPE2.3 External links

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10918&cat=SIRT_1&actp=LIST


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###