CVE-2017-10605 Junos: SRX Series denial of service vulnerability in flowd due to crafted DHCP packet

On all vSRX and SRX Series devices, when the DHCP or DHCP relay is configured, specially crafted packet might cause the flowd process to crash, halting or interrupting traffic from flowing through the devices. Repeated crashes of the flowd process may constitute an extended denial of service...

CVE-2017-2344

CVE-2017-2344 affects Juniper Networks Junos OS, where a buffer overflow in the internal Junos OS sockets library can be exploited locally by programs running on affected devices. The vulnerability may lead to kernel panics (denial of service) or enable privilege escalation to arbitrary code exec...

CVE-2017-10605

On Junos OS for vSRX/SRX Series, DHCP or DHCP relay can trigger flowd crashes via specially crafted DHCP packets, causing traffic interruption and potential extended DoS with failover implications. Affected releases include 12.1X46 before 12.1X46-D67, 12.3X48 before 12.3X48-D50, and 15.1X49 befor...

CVE-2017-2341

CVE-2017-2341 covers an insufficient authentication vulnerability in Junos OS when run in a virtualized environment, enabling a guest to escalate to the host. Affected Junos OS releases include 14.1X53 pre-D40 (QFX5110, QFX5200, QFX10002/10008/10016, EX4600, NFX250), 15.1 pre-R5 (EX4600), 15.1X49...

CVE-2017-2338 ScreenOS: XSS vulnerability in ScreenOS Firewall

A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the...

CVE-2017-10603

The CVE describes an XML injection vulnerability in Junos OS CLI that can be exploited by a locally authenticated user to elevate privileges and execute commands as root. The issue stems from improper handling/validation of XML content received by the CLI, enabling arbitrary command execution wit...

CVE-2017-2349

The CVE-2017-2349 entry describes a remote command injection in Juniper Junos OS SRX series IDP feature. Affected releases include Junos OS 12.1X44 (before 12.1X44-D60), 12.1X46 (before 12.1X46-D50), 12.1X47 (before 12.1X47-D30, D35), 12.3X48 (before 12.3X48-D20, D30), and 15.1X49 (before 15.1X49...

CVE-2017-2337 ScreenOS: XSS vulnerability in ScreenOS Firewall

A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the...

CVE-2017-10604

CVE-2017-10604 affects Juniper SRX Series devices running Junos OS in cluster mode. The issue arises when account lockout is enabled: an unauthenticated user making failed root login attempts can trigger root lockout, which in turn causes cluster sync or failover errors. Affected releases are SRX...

CVE-2017-2347 Junos: Denial of Service vulnerability in rpd daemon

A denial of service vulnerability in rpd daemon of Juniper Networks Junos OS allows a malformed MPLS ping packet to crash the rpd daemon if MPLS OAM is configured. Repeated crashes of the rpd daemon can result in an extended denial of service condition for the device. The affected releases are...

CVE-2017-10601

CVE-2017-10601 affects Junos OS where a specific device configuration can cause a commit failure, enabling login without password during console/SSH/FTP/Telnet/Su attempts. Affected releases include Junos OS 12.3 prior to 12.3R10, 12.3R11; 12.3X48 prior to 12.3X48-D20; 13.2 prior to 13.2R8; 13.3 ...

CVE-2017-2347

The CVE affects Juniper Networks Junos OS rpd daemon, via improper handling of a malformed MPLS ping packet when MPLS OAM is configured. Affected releases include Junos OS 12.3X48 (before -D50/-D55), 13.3 before 13.3R10, 14.1 before 14.1R4-S13/14.1R8-S3/14.1R9, 14.1X53 before 14.1X53-D42/D50, 14....

CVE-2017-2349 SRX Series: Command injection vulnerability in SRX IDP feature.

A command injection vulnerability in the IDP feature of Juniper Networks Junos OS on SRX series devices potentially allows a user with login access to the device to execute shell commands and elevate privileges. Affected releases are Juniper Networks Junos OS 12.1X44 prior to 12.1X44-D60; 12.1X46...

CVE-2017-2345

Technical details for CVE-2017-2345 are not publicly available in the provided connected documents. Monitor for updates; the supplied materials do not specify affected Junos releases beyond the initial description.

CVE-2017-2348

The CVE-2017-2348 issue affects Juniper Networks Junos OS where the jdhcpd daemon may experience high CPU utilization or crash when handling invalid IPv6 UDP packets, leading to a denial of service by interrupting DHCP service. Affected releases include Junos OS 14.1X53 before certain D-branch fi...

CVE-2017-2341 Junos OS: VM to host privilege escalation in platforms with Junos OS running in a virtualized environment.

An insufficient authentication vulnerability on platforms where Junos OS instances are run in a virtualized environment, may allow unprivileged users on the Junos OS instance to gain access to the host operating environment, and thus escalate privileges. Affected releases are Juniper Networks Jun...

CVE-2017-10603 Junos OS: Local XML Injection through CLI command can lead to privilege escalation

An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 15.1X53 prior to 15.1X53-D47, 15....

CVE-2017-2348 Junos OS: jdhcpd daemon crash due to invalid IPv6 UDP packets

The Juniper Enhanced jdhcpd daemon may experience high CPU utilization, or crash and restart upon receipt of an invalid IPv6 UDP packet. Both high CPU utilization and repeated crashes of the jdhcpd daemon can result in a denial of service as DHCP service is interrupted. No other Juniper Networks...

CVE-2017-2338

CVE-2017-2338 describes a persistent cross-site scripting (XSS) vulnerability in Juniper Networks ScreenOS WebUI used by NetScreen Firewall+VPN. A user with the security role can inject HTML/JavaScript into other users’ management sessions, potentially granting the attacker the ability to execute...

CVE-2017-2314

The CVE-2017-2314 issue affects Juniper Junos OS, specifically the routing protocol daemon (rpd). It is triggered by receiving a malformed BGP OPEN message, which can cause rpd to crash and restart, resulting in a denial of service. Affected Junos releases include 12.3 (before 12.3R12-S4, 12.3R13...