CVE-2017-10601: Improper Authentication

A specific device configuration can result in a commit failure condition. When this occurs, a user is logged in without being prompted for a password while trying to login through console, ssh, ftp, telnet or su, etc., This issue relies upon a device configuration precondition to occur. Typically...

CVE-2017-2348: Uncontrolled Resource Consumption

The Juniper Enhanced jdhcpd daemon may experience high CPU utilization, or crash and restart upon receipt of an invalid IPv6 UDP packet. Both high CPU utilization and repeated crashes of the jdhcpd daemon can result in a denial of service as DHCP service is interrupted. No other Juniper Networks...

CVE-2017-2342: Missing Report of Error Condition

MACsec feature on Juniper Networks Junos OS 15.1X49 prior to 15.1X49-D100 on SRX300 series does not report errors when a secure link can not be established. It falls back to an unencrypted link. This can happen when MACsec is configured on ports that are not capable of MACsec or when a secure lin...

CVE-2017-2335: Improper Neutralization of Input During Web Page Generation

A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the...

CVE-2017-2337: Improper Neutralization of Input During Web Page Generation

A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the...

CVE-2017-2343: Use of Hard-coded Credentials

The Integrated User Firewall UserFW feature was introduced in Junos OS version 12.1X47-D10 on the Juniper SRX Series devices to provide simple integration of user profiles on top of the existing firewall polices. As part of an internal security review of the UserFW services authentication API,...

CVE-2017-2341: Improper Authentication

An insufficient authentication vulnerability on platforms where Junos OS instances are run in a virtualized environment, may allow unprivileged users on the Junos OS instance to gain access to the host operating environment, and thus escalate privileges. Affected releases are Juniper Networks Jun...

CVE-2017-10604: Improper Restriction of Excessive Authentication Attempts

When the device is configured to perform account lockout with a defined period of time, any unauthenticated user attempting to log in as root with an incorrect password can trigger a lockout of the root account. When an SRX Series device is in cluster mode, and a cluster sync or failover operatio...

CVE-2017-2335

Juniper ScreenOS XSS vulnerability CVE-2017-2335 affects ScreenOS on Juniper SSG Series devices (Firewall+VPN) prior to 6.3.0r24. Affected component is the NetScreen WebUI where a user with the security role can inject HTML/JavaScript into other users’ management sessions, potentially gaining an ...

CVE-2017-2346

The CVE-2017-2346 issue affects Juniper Networks Junos OS on MX platforms, where an ALG handling of large fragmented packets can crash the MS-MPC/MS-MIC Service PIC, causing extended DoS. Impact is confined to specific Junos versions on MX hardware (e.g., 14.1X55-D30 to before 14.1X55-D35; 14.2R7...

CVE-2017-2346 MS-MPC or MS-MIC crash when passing large fragmented traffic through an ALG

An MS-MPC or MS-MIC Service PIC may crash when large fragmented packets are passed through an Application Layer Gateway ALG. Repeated crashes of the Service PC can result in an extended denial of service condition. The issue can be seen only if NAT or stateful-firewall rules are configured with...

CVE-2017-10602

CVE-2017-10602 describes a buffer overflow in Junos OS CLI that can allow a local authenticated user with read-only CLI access to execute code with root privileges. Affected releases include Junos OS versions across multiple lines of products: 14.1X53 (prior to 14.1X53-D46 on EX2200/VC, EX3200, E...

CVE-2017-2343 SRX Series: Hardcoded credentials in Integrated UserFW feature.

The Integrated User Firewall UserFW feature was introduced in Junos OS version 12.1X47-D10 on the Juniper SRX Series devices to provide simple integration of user profiles on top of the existing firewall polices. As part of an internal security review of the UserFW services authentication API,...

CVE-2017-2341

CVE-2017-2341 covers an insufficient authentication vulnerability in Junos OS when run in a virtualized environment, enabling a guest to escalate to the host. Affected Junos OS releases include 14.1X53 pre-D40 (QFX5110, QFX5200, QFX10002/10008/10016, EX4600, NFX250), 15.1 pre-R5 (EX4600), 15.1X49...

CVE-2017-2348

The CVE-2017-2348 issue affects Juniper Networks Junos OS where the jdhcpd daemon may experience high CPU utilization or crash when handling invalid IPv6 UDP packets, leading to a denial of service by interrupting DHCP service. Affected releases include Junos OS 14.1X53 before certain D-branch fi...

CVE-2017-2344

CVE-2017-2344 affects Juniper Networks Junos OS, where a buffer overflow in the internal Junos OS sockets library can be exploited locally by programs running on affected devices. The vulnerability may lead to kernel panics (denial of service) or enable privilege escalation to arbitrary code exec...

CVE-2017-10601

CVE-2017-10601 affects Junos OS where a specific device configuration can cause a commit failure, enabling login without password during console/SSH/FTP/Telnet/Su attempts. Affected releases include Junos OS 12.3 prior to 12.3R10, 12.3R11; 12.3X48 prior to 12.3X48-D20; 13.2 prior to 13.2R8; 13.3 ...

CVE-2017-2335 ScreenOS: XSS vulnerability in ScreenOS Firewall

A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the...

CVE-2017-2339

The CVE-2017-2339 issue concerns a persistent cross-site scripting (XSS) vulnerability in Juniper Networks ScreenOS, specifically within the NetScreen WebUI of the ScreenOS-based NetScreen Firewall+VPN. The vulnerability allows a user with the security role to inject HTML/JavaScript into other us...

CVE-2017-2314 Junos: RPD crash due to malformed BGP OPEN message

Receipt of a malformed BGP OPEN message may cause the routing protocol daemon rpd process to crash and restart. By continuously sending specially crafted BGP OPEN messages, an attacker can repeatedly crash the rpd process causing prolonged denial of service. No other Juniper Networks products or...