Juniper Junos Multiple sfid Daemon Malformed Packet Remote DoS (PSN-2011-04-241)

The remote device is a Juniper EX Series switch running Junos 11.1R1. The sfid daemon on the line card may crash repeatedly due to improper parsing of NetBIOS packets. A remote attacker could exploit this to cause a denial of service. C Tenable Network Security, Inc. include"compat.inc"; if...

Juniper Junos J-Web Weak SSL Ciphers (PSN-2011-01-147)

According to its self-reported version number, the remote Junos device contains a J-Web component that supports the use of weak SSL ciphers less than 128-bit. Note: This is considerably easier to exploit if the attacker is on the same physical network. C Tenable Network Security, Inc...

Juniper Junos debug.php J-Web Component Unauthenticated Debug Access (PSN-2011-02-158)

According to its self-reported version number, the remote device is running a version of Junos with a vulnerable J-Web component. The 'debug.php' file was inadvertently included with this Junos release. This file enables unspecified debugging functions and output. A remote, unauthenticated attack...

Juniper Junos Fragmented ICMP Packet Handling Remote DoS (PSN-2011-07-298)

According to its self-reported version number, the remote Juniper router is running a version of Junos with a denial of service vulnerability. Receiving a burst of fragmented ICMP packets can cause the router to become unresponsive until it is rebooted. A remote, unauthenticated attacker could...

Juniper Junos IPv6 over IPv4 Security Policy Bypass (PSN-2011-07-299)

According to its self-reported version number, the remote Juniper device is running a version of Junos with a security bypass vulnerability. When the device is configured to perform IPv6 in IPv4 tunneling, policies that apply to the encapsulated datagram are not enforced. A remote, unauthenticate...

Junos Version Detection

The remote host is running Junos, an operating system for Juniper devices. It is possible to read the Junos version number by logging into the device via SSH, using SNMP, or viewing the web interface. TRUSTED...

Juniper Junos ICMP Ping 'composite next-hop' Remote DoS (PSN-2011-07-297)

According to its self-reported version number, the remote Juniper router is running a version of Junos that is affected by a denial of service vulnerability. Sending an ICMP ping with the record-route or timestamp options can crash an L3VPN PE router with either of the following configurations : ...

Juniper Junos PIM rpd Crafted Boot Message Remote DoS (PSN-2011-07-296)

According to its self-reported version number, the remote Juniper router is running a version of Junos with a denial of service vulnerability. Sending a specially crafted bootstrap message to the PIM router can cause the rpd routing daemon to crash. A remote, unauthenticated attacker could exploi...

Juniper Website - Cross Site Scripting Vulnerabilities

Document Title: =============== Juniper Website - Cross Site Scripting Vulnerabilities Release Date: ============= 2011-08-13 Vulnerability Laboratory ID VL-ID: ==================================== 248 Product & Service Introduction: =============================== Networking and security solutio...

Juniper Website - Cross Site Scripting Vulnerabilities

Document Title: =============== Juniper Website - Cross Site Scripting Vulnerabilities Release Date: ============= 2011-08-13 Vulnerability Laboratory ID VL-ID: ==================================== 248 Product & Service Introduction: =============================== Networking and security solutio...

Juniper Networks Junos OS DoS Vulnerability (CVE-2004-0468)

Memory leak in Juniper JUNOS Packet Forwarding Engine PFE allows remote attackers to cause a denial of service DoS via certain IPv6 packets. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Juniper Networks Junos OS CVE-2009-3485

Cross-site scripting XSS vulnerability in the J-Web interface in Juniper JUNOS 8.5R1.14 and 9.0R1.1 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a...

Juniper Networks Junos OS Detection (SSH Login)

SSH login-based detection of Juniper Networks Junos OS. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ICMPv6 Router Announcement flooding denial of service affecting multiple systems

This security advisory is released because Microsoft doesnt want to fix the issue. Cisco did for its IOS and ASA within 3 months. Title: ICMPv6 Router Announcement flooding denial of service affecting multiple systems Date: 05 April 2011 URL:...

Juniper VPN client rdesktop clickhack

Juniper VPN client rdesktop clickhack ================================ discovered by [email protected] PRODUCT: Juniper VPN client + Windows remote desktop or console access VERSION AFFECTED: Win Vista/7 + Juniper VPN client all versions EXPOSURE: Remote code execution SYSTEM privileges SYNOPSIS...

Juniper VPN client unauthorized access

It's possible to execute Internet Explorer with System rights before authentication via remote session...

Juniper VPN Client rdesktop Click Hack

Juniper VPN client rdesktop clickhack ================================ discovered by [email protected] PRODUCT: Juniper VPN client + Windows remote desktop or console access VERSION AFFECTED: Win Vista/7 + Juniper VPN client all versions EXPOSURE: Remote code execution SYSTEM privileges SYNOPSIS...

Juniper SSL VPN Bypass / Cross Site Scripting

This reminded me of a bunch of problems I spotted in Juniper SSL VPN a while ago; they are apparently fixed, but I don't recall seeing any public vendor advisory / credit for reporting them - so here you go, even if just for the record... These were fixed by Juniper in IVE 6.3R1, 6.2R3, 6.1R5,...

ZDI-10-231: Juniper Secure Access Series meeting_testjava.cgi XSS Vulnerability

ZDI-10-231: Juniper Secure Access Series meetingtestjava.cgi XSS Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-231 November 7, 2010 -- CVSS: 6.4, AV:N/AC:L/Au:N/C:P/I:P/A:N -- Affected Vendors: Juniper -- Affected Products: Juniper Secure Access Series -- TippingPointTM IPS...

some ooold Juniper bugs (was: [Full-disclosure] ZDI-10-231: Juniper Secure Access Series meeting_testjava.cgi XSS Vulnerability)

This reminded me of a bunch of problems I spotted in Juniper SSL VPN a while ago; they are apparently fixed, but I don't recall seeing any public vendor advisory / credit for reporting them - so here you go, even if just for the record... These were fixed by Juniper in IVE 6.3R1, 6.2R3, 6.1R5,...