CVE-2017-2314 Junos: RPD crash due to malformed BGP OPEN message

Receipt of a malformed BGP OPEN message may cause the routing protocol daemon rpd process to crash and restart. By continuously sending specially crafted BGP OPEN messages, an attacker can repeatedly crash the rpd process causing prolonged denial of service. No other Juniper Networks products or...

CVE-2017-2337 ScreenOS: XSS vulnerability in ScreenOS Firewall

A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the...

CVE-2017-2344

CVE-2017-2344 affects Juniper Networks Junos OS, where a buffer overflow in the internal Junos OS sockets library can be exploited locally by programs running on affected devices. The vulnerability may lead to kernel panics (denial of service) or enable privilege escalation to arbitrary code exec...

CVE-2017-10603 Junos OS: Local XML Injection through CLI command can lead to privilege escalation

An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 15.1X53 prior to 15.1X53-D47, 15....

CVE-2017-10601

CVE-2017-10601 affects Junos OS where a specific device configuration can cause a commit failure, enabling login without password during console/SSH/FTP/Telnet/Su attempts. Affected releases include Junos OS 12.3 prior to 12.3R10, 12.3R11; 12.3X48 prior to 12.3X48-D20; 13.2 prior to 13.2R8; 13.3 ...

CVE-2017-2341

CVE-2017-2341 covers an insufficient authentication vulnerability in Junos OS when run in a virtualized environment, enabling a guest to escalate to the host. Affected Junos OS releases include 14.1X53 pre-D40 (QFX5110, QFX5200, QFX10002/10008/10016, EX4600, NFX250), 15.1 pre-R5 (EX4600), 15.1X49...

CVE-2017-2346

The CVE-2017-2346 issue affects Juniper Networks Junos OS on MX platforms, where an ALG handling of large fragmented packets can crash the MS-MPC/MS-MIC Service PIC, causing extended DoS. Impact is confined to specific Junos versions on MX hardware (e.g., 14.1X55-D30 to before 14.1X55-D35; 14.2R7...

CVE-2017-2342

CVE-2017-2342 affects Juniper Networks Junos OS on SRX300 series (15.1X49 prior to 15.1X49-D100). The MACsec feature may not report errors when a secure link cannot be established, causing a fallback to an unencrypted link and potentially misleading operators into believing the connection is secu...

CVE-2017-2335 ScreenOS: XSS vulnerability in ScreenOS Firewall

A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the...

CVE-2017-10605 Junos: SRX Series denial of service vulnerability in flowd due to crafted DHCP packet

On all vSRX and SRX Series devices, when the DHCP or DHCP relay is configured, specially crafted packet might cause the flowd process to crash, halting or interrupting traffic from flowing through the devices. Repeated crashes of the flowd process may constitute an extended denial of service...

CVE-2017-2336

CVE-2017-2336 is a reflected cross-site scripting vulnerability in Juniper ScreenOS (NetScreen Firewall+VPN) affecting ScreenOS 6.3.x prior to 6.3.0r24 on SSG Series. The issue allows a network-based attacker to inject HTML/JavaScript into a management session of other users, including administra...

CVE-2017-10602

CVE-2017-10602 describes a buffer overflow in Junos OS CLI that can allow a local authenticated user with read-only CLI access to execute code with root privileges. Affected releases include Junos OS versions across multiple lines of products: 14.1X53 (prior to 14.1X53-D46 on EX2200/VC, EX3200, E...

CVE-2017-2314

The CVE-2017-2314 issue affects Juniper Junos OS, specifically the routing protocol daemon (rpd). It is triggered by receiving a malformed BGP OPEN message, which can cause rpd to crash and restart, resulting in a denial of service. Affected Junos releases include 12.3 (before 12.3R12-S4, 12.3R13...

CVE-2017-2339

The CVE-2017-2339 issue concerns a persistent cross-site scripting (XSS) vulnerability in Juniper Networks ScreenOS, specifically within the NetScreen WebUI of the ScreenOS-based NetScreen Firewall+VPN. The vulnerability allows a user with the security role to inject HTML/JavaScript into other us...

CVE-2017-10605

On Junos OS for vSRX/SRX Series, DHCP or DHCP relay can trigger flowd crashes via specially crafted DHCP packets, causing traffic interruption and potential extended DoS with failover implications. Affected releases include 12.1X46 before 12.1X46-D67, 12.3X48 before 12.3X48-D50, and 15.1X49 befor...

CVE-2017-2347

The CVE affects Juniper Networks Junos OS rpd daemon, via improper handling of a malformed MPLS ping packet when MPLS OAM is configured. Affected releases include Junos OS 12.3X48 (before -D50/-D55), 13.3 before 13.3R10, 14.1 before 14.1R4-S13/14.1R8-S3/14.1R9, 14.1X53 before 14.1X53-D42/D50, 14....

CVE-2017-2343

CVE-2017-2343 affects Juniper Junos SRX Series with the Integrated User Firewall (UserFW) authentication API. The root cause is hardcoded credentials in UserFW, enabling an unauthenticated, remote attacker to potentially gain administrative access to the SRX device and compromise connected servic...

CVE-2017-2335

Juniper ScreenOS XSS vulnerability CVE-2017-2335 affects ScreenOS on Juniper SSG Series devices (Firewall+VPN) prior to 6.3.0r24. Affected component is the NetScreen WebUI where a user with the security role can inject HTML/JavaScript into other users’ management sessions, potentially gaining an ...

CVE-2017-2337

CVE-2017-2337 concerns a persistent XSS flaw in Juniper Networks ScreenOS, affecting the NetScreen/WebUI of SSG Series devices. The issue allows a user with the 'security' role to inject HTML/JavaScript into another user’s management session, including administrators, effectively enabling command...

CVE-2017-2342 SRX Series: MACsec failure to report errors

MACsec feature on Juniper Networks Junos OS 15.1X49 prior to 15.1X49-D100 on SRX300 series does not report errors when a secure link can not be established. It falls back to an unencrypted link. This can happen when MACsec is configured on ports that are not capable of MACsec or when a secure lin...