Multiple Juniper Networks Flaw Let Attackers Delete Files
The Juniper networks-owned Junos OS has been realized to have extra than one vulnerabilities linked to Denial of Provider (DoS), Path Traversal, and Unpleasant-Put Scripting (XSS).
The CVEs for these vulnerabilities have been assigned with CVE-2024-30409, CVE-2020-1606, and CVE-2020-1607.
The severity for these vulnerabilities ranges between 5.3 (Medium) to 7.5 (High). On the other hand, these vulnerabilities have been patched by Juniper networks, and linked safety advisories have been printed to address them.
Vulnerability Significant beneficial properties
Per the advisory released, the DoS used to be known ensuing from Greater CPU consumption on the routing engine, the route traversal, and the spoiled-plight scripting vulnerabilities that existed in the J-Net Interface and Junos OS.
These vulnerabilities impact extra than one Juniper network products and variations.
AI-Powered Protection for Change E mail Security
Trustifi’s Superior possibility safety prevents the widest spectrum of subtle assaults prior to they reach a consumer’s mailbox. Stopping 99% of phishing assaults omitted by other electronic mail safety alternatives. .
CVE-2024-30409 : Greater CPU consumption On Routing Rngine Leads To Denial Of Provider
This vulnerability exists in extra than one variations of Junos OS and JunosOS developed ensuing from unfriendly take a look at for abnormal or distinctive prerequisites in the telemetry processing.
This vulnerability permits an authenticated network-essentially essentially based attacker to cause a denial of carrier situation by crashing the ahead info sinful telemetry daemon (fibtd).
The severity for this vulnerability used to be given as 5.3 (Medium) in step with CVSS v3 rating and 6.9 (Medium) as per CVSS v4 rating.
Furthermore, this vulnerability is seen when the telemetry subscription is sharp and Fib-streaming is enabled.
No workarounds were mentioned to mitigate this vulnerability.
CVE-2020-1606: Path Traversal Vulnerability In J-Net
This vulnerability exists in the Junos OS devices, which can presumably per chance allow an authenticated attacker with J-internet client privilege to learn or delete recordsdata with “world” readable and writable permissions.
On the other hand, without root client privilege, this vulnerability can not have vital impact on diagram recordsdata.
As a workaround, customers of affected Junos OS variations can restrict the entry to J-internet interface to handiest relied on customers for reducing the exploitation possibility.
On the other hand, as a prerequisite, the J-internet interface ought to be enabled on the affected tool.
CVE-2020-1607: Unpleasant-Put Scripting (XSS) In J-Net
This vulnerability exists ensuing from insufficient XSS safety in the J-internet interface, which can presumably per chance allow a possibility actor to inject internet script or HTML.
This script injection can potentially outcome in hijacking of client’s or administrator’s J-Net session that will also be faded to create administrative action on the Junos OS under the impact of the targeted client.
As a workaround for this vulnerability, customers will also be attach aside to entry the J-internet carrier handiest from relied on sources corresponding to jumphosts and not using a info superhighway entry.
Alternatively, the J-internet interface can moreover be disabled.
Affected Merchandise And Fastened In Variations
CVE | Affected Merchandise | Fastened in variations |
CVE-2024-30409 | Junos OS:from 22.1 prior to 22.1R1-S2, 22.1R2. Junos OS Evolved:from 22.1 prior to 22.1R1-S2-EVO, 22.1R2-EVO. |
Junos OS: 22.1R1-S2, 22.1R2, 22.2R1, 22.2R2, 22.3R1, 22.4R1, and all subsequent releases. Junos OS Evolved: 22.1R1-S2-EVO, 22.1R2-EVO, 22.2R1-EVO, 22.2R2-EVO, 22.3R1-EVO, 22.4R1-EVO, and all subsequent releases. |
CVE-2020-1606 | 12.3 variations prior to 12.3R12-S13;12.3X48 variations prior to 12.3X48-D85 on SRX Sequence;14.1X53 variations prior to 14.1X53-D51;15.1F6 variations prior to fifteen.1F6-S13;15.1 variations prior to fifteen.1R7-S5;15.1X49 variations prior to fifteen.1X49-D180 on SRX Sequence;15.1X53 variations prior to fifteen.1X53-D238 on QFX5200/QFX5110 Sequence;16.1 variations prior to 16.1R4-S13, 16.1R7-S5;16.2 variations prior to 16.2R2-S10;17.1 variations prior to 17.1R3-S1;17.2 variations prior to 17.2R1-S9, 17.2R3-S2;17.3 variations prior to 17.3R2-S5, 17.3R3-S5;17.4 variations prior to 17.4R2-S9, 17.4R3;18.1 variations prior to 18.1R3-S8;18.2 variations prior to 18.2R3;18.3 variations prior to 18.3R2-S3, 18.3R3;18.4 variations prior to 18.4R2;19.1 variations prior to 19.1R1-S4, 19.1R2. | 12.3R12-S13, 12.3X48-D85, 14.1X53-D51, 15.1F6-S13, 15.1R7-S5, 15.1X49-D180, 15.1X53-D238, 16.1R4-S13, 16.1R7-S5, 16.2R2-S10, 17.1R3-S1, 17.2R1-S9, 17.2R3-S2, 17.3R2-S5, 17.3R3-S5, 17.4R2-S9, 17.4R3, 18.1R3-S8, 18.2R3, 18.3R2-S3, 18.3R3, 18.4R2, 19.1R1-S4, 19.1R2, 19.2R1, and all subsequent releases. |
CVE-2020-1607 | 12.3 variations prior to 12.3R12-S15;12.3X48 variations prior to 12.3X48-D86, 12.3X48-D90 on SRX Sequence;14.1X53 variations prior to 14.1X53-D51 on EX and QFX Sequence;15.1F6 variations prior to fifteen.1F6-S13;15.1 variations prior to fifteen.1R7-S5;15.1X49 variations prior to fifteen.1X49-D181, 15.1X49-D190 on SRX Sequence;15.1X53 variations prior to fifteen.1X53-D238 on QFX5200/QFX5110 Sequence;15.1X53 variations prior to fifteen.1X53-D592 on EX2300/EX3400 Sequence;16.1 variations prior to 16.1R4-S13, 16.1R7-S5;16.2 variations prior to 16.2R2-S10;17.1 variations prior to 17.1R2-S11, 17.1R3-S1;17.2 variations prior to 17.2R1-S9, 17.2R3-S2;17.3 variations prior to 17.3R2-S5, 17.3R3-S5;17.4 variations prior to 17.4R2-S6, 17.4R3;18.1 variations prior to 18.1R3-S7;18.2 variations prior to 18.2R2-S5, 18.2R3;18.3 variations prior to 18.3R1-S6, 18.3R2-S1, 18.3R3;18.4 variations prior to 18.4R1-S5, 18.4R2;19.1 variations prior to 19.1R1-S2, 19.1R2. | 12.3R12-S15, 12.3X48-D86, 12.3X48-D90, 14.1X53-D51, 15.1F6-S13,15.1R7-S5, 15.1X49-D181, 15.1X49-D190, 15.1X53-D238, 15.1X53-D592, 16.1R4-S13, 16.1R7-S5, 16.2R2-S10,17.1R2-S11, 17.1R3-S1, 17.2R1-S9, 17.2R3-S2, 17.3R2-S5, 17.3R3-S5, 17.4R2-S6, 17.4R3, 18.1R3-S7,18.2R2-S5, 18.2R3, 18.3R1-S6, 18.3R2-S1, 18.3R3, 18.4R1-S5, 18.4R2, 19.1R1-S2, 19.1R2, 19.2R1, and all subsequent releases. |
Users of these Junos OS and Junos OS developed products are urged to toughen to the most modern variations in portray to forestall the exploitation of these vulnerabilities by possibility actors.
Source credit : cybersecuritynews.com