Product Affected:
This issue can affect any product or platform running Junos OS.
Problem:
When the pam.conf file is
corrupted in certain ways, it may allow connection to the device as the
root user with no password. This "fail-open" behavior allows an attacker
who can specifically modify the file to gain full access to the device.
Note
that inadvertent manipulation of the pam.conf by an authorized
administrator can also lead to unauthenticated root access to the
device. Extreme care should be taken by administrators to avoid
modifying pam.conf directly.
While the standalone vulnerability
may not be directly exploitable, this issue increases the severity of
other attacks that may be chained together to launch a multi-stage
advanced attack against the device.
This issue is assigned CVE-2015-7751.
Solution:
The following software
releases have been updated to resolve this specific issue: Junos OS
12.1X44-D50, 12.1X46-D35, 12.1X47-D25, 12.3R9, 12.3X48-D15, 13.2R7,
13.2X51-D35, 13.3R6, 14.1R5, 14.1X50-D105, 14.1X51-D70, 14.1X53-D25,
14.1X55-D20, 14.2R1, 15.1F2, 15.1R1, 15.1X49-D10, and all subsequent
releases.
This issue was found during internal product security testing.
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
No other Juniper Networks products or platforms are affected by this issue.
This issue is being tracked as PR 965378 and is visible on the Customer Support website.
KB16765
- "In which releases are vulnerabilities fixed?" describes which
release vulnerabilities are fixed as per our End of Engineering and End
of Life support policies.
Workaround:
Use access lists or firewall filters to limit CLI access to the router only from trusted hosts.
In
addition to the recommendations listed above, it is good security
practice to limit the exploitable attack surface of critical
infrastructure networking equipment. Use access lists or firewall
filters to limit access to the router via SSH or telnet only from
trusted, administrative networks or hosts.
No comments:
Post a Comment