SB2021041604 - Security restrictions bypass in multi-tenant environments in Juniper Junos OS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021041604

SB2021041604 - Security restrictions bypass in multi-tenant environments in Juniper Junos OS

Published: April 16, 2021

Security Bulletin ID SB2021041604
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Security restrictions bypass (CVE-ID: CVE-2021-0235)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to system does not properly impose security restrictions in a multi-tenant environment. On SRX1500, SRX4100, SRX4200, SRX4600, SRX5000 Series with SPC2/SPC3, vSRX Series devices using tenant services on Juniper Networks Junos OS, due to incorrect permission scheme assigned to tenant system administrators, a tenant system administrator may inadvertently send their network traffic to one or more tenants while concurrently modifying the overall device system traffic management, affecting all tenants and the service provider. Further, a tenant may inadvertently receive traffic from another tenant.


Remediation

Install update from vendor's website.

References