Juniper Junos web-authentication Policy Not Enforced (PSN-2012-10-735)

According to its self-reported version number, the remote Junos device stops enforcing a web-authentication policy if its client-match statement is removed. This would allow unauthenticated access to resources that are assumed to be protected by web-authentication. C Tenable Network Security, Inc...

Juniper Junos lo0 Firewall Bypass (PSN-2012-07-651)

According to its self-reported version number, the remote Junos router has a firewall bypass vulnerability. This issue is present when log or syslog actions are used along with discard within a firewall filter term deployed on the lo0 loopback interface. When the receive rate is very high, some...

Juniper Junos OpenSSL ASN.1 Memory Corruption (PSN-2012-07-645)

According to its self-reported version number, the remote Junos router is using an outdated version of OpenSSL. Parsing malformed ASN.1 encoded data can result in memory corruption. This vulnerability can be triggered by attempting to parse untrusted data e.g., an X.509 certificate. C Tenable...

Juniper Junos ICMPv6 DoS (PSN-2012-07-644)

According to its self-reported version number, the remote Junos router has a denial of service vulnerability. Receiving an ICMPv6 packet with a corrupted payload within an IPv6 L3VPN can result in a kernel panic. Only VPNv6 configurations without the 'vrf-table-label' statement in the routing...

Juniper Junos J-Web Hash Collision DoS (PSN-2012-07-650)

According to its self-reported version number, the remote Junos device has a denial of service vulnerability in the J-Web component. It is possible to send requests to the web server that result in hash collisions, resulting in CPU consumption. C Tenable Network Security, Inc. include"compat.inc"...

Juniper Junos IS-IS hello DoS (PSN-2012-07-647)

According to its self-reported version number, the rpd daemon on remote Junos router may crash when processing malformed IS-IS hello messages. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid59991; scriptversion"1.8"; scriptcvsdate"Date: 2018/08/08 12:52:14";...

Juniper Junos J-Web XSS (PSN-2012-07-649)

According to its self-reported version number, the remote Junos device has a cross-site scripting vulnerability in the J-Web component. Unspecified input to index.php can result in cross-site scripting. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid59993;...

Juniper Junos PIM DoS (PSN-2012-07-648)

According to its self-reported version number, the remote router has a denial of service vulnerability. Sending a specially crafted broadcast storm of corrupt packets to the data multicast distribution tree port of a Junos router can cause the rpd daemon to hang. Only routers with PIM enabled in ...

Juniper Junos host-inbound-traffic Implicit Allow (PSN-2012-07-653)

According to its self-reported version number, the remote Junos device allows inbound SSH traffic even when 'host-inbound-traffic' is not explicitly configured to allow it. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid59997; scriptversion"1.9"; scriptcvsdate"Date:...

Juniper Junos UDP/IP DoS (PSN-2012-07-652)

According to its self-reported version number, the remote Junos device has a denial of service vulnerability. The flowd process may crash when reassembling UDP/IP fragments. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid59996; scriptversion"1.8"; scriptcvsdate"Date:...

Juniper Junos load factory-default Privilege Escalation (PSN-2012-07-646)

According to its self-reported version number, the remote Junos device has a privilege escalation vulnerability. When the 'load factory-default' command fails in exclusive edit mode, the user is no longer subject to any command or configuration restrictions. C Tenable Network Security, Inc...

Juniper Junos SYN Cookie Protection DoS (PSN-2012-07-643)

According to its self-reported version number, the SYN cookie protection implementation of the remote Junos system has a denial of service vulnerability. If SYN flood protection is enabled and the SYN cookie protection threshold is exceeded, the server responds to connections with an RST, causing...

Juniper Junos SSH TACACS+ Incorrect Permissions (PSN-2012-04-545)

According to its self-reported version number, the version of Junos running on the remote host may grant permissions incorrectly when SSH sessions are authenticated remotely using TACACS+ for authentication and authorization. Fetched authorizations are stored in a file whose name is based on...

Juniper Junos Key Generation Weakness (PSN-2012-04-549)

According to its self-reported version and model number, the remote Junos device generates weak cryptographic keys for SSL and SSH. Due to a lack of entropy in the initial certificate creation, duplicate keys may be created on multiple devices. An attacker with knowledge of these keys would allow...

Juniper Junos J-Web CPU Utilization DoS (PSN-2012-04-547)

According to its self-reported version number, the J-Web component of the remote Junos system has a denial of service vulnerability. A high rate of inbound HTTP connections over an extended period can result in high CPU utilization, even after the connections are terminated. A remote,...

Juniper Junos MPLS DoS (PSN-2012-04-546)

According to its self-reported version number, the version of Junos running on the remote host has a denial of service vulnerability. When MPLS is enabled, receiving a high rate of Pseudo Wire l2vpn or l2circuit control words from an adjacent node can cause the routing engine RE to become...

Juniper Junos SRX Series for the Data Center Memory Corruption (PSN-2012-04-548)

According to its self-reported version and model number, the version of Junos running on the remote host has a memory corruption vulnerability. When an IPv6 flow session is freed on the Central Point CP, CP session statistics are updated. In some situations this update results in memory corruptio...

Juniper Junos BGP UPDATE Malformed ATTR_SET Attribute Remote DoS (PSN-2012-01-472)

According to its self-reported version number, the version of Junos running on the remote device has a denial of service vulnerability. Processing a BGP UPDATE containing a corrupted ATTRSET attribute can result in an rpd crash. This issue only affects routers configured for BGP running Junos 10....

Juniper Junos J-Web Component Unspecified CSRF (PSN-2012-01-474)

According to its self-reported version number, the J-Web component of the remote Juniper device has a cross-site request forgery vulnerability. A remote attacker could exploit this by tricking a user into making a maliciously crafted request, resulting in a compromise of the device. C Tenable...

Juniper Junos MGD-CLI Arbitrary Command Execution (PSN-2011-11-418)

According to its self-reported version number, the version of Junos running on the remote device has a command execution vulnerability. A flaw in the logical model governing inter-process communications between the management daemon MGD and the command-line interpreter CLI could result in arbitra...