Virtual Event: Threat Detection and Incident Response Summit - Watch Sessions
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Network Security

Juniper Networks Patches Several Flaws With Junos Updates

Updates released by Juniper Networks for its Junos operating system patch several high and medium severity vulnerabilities. The company has also updated some of the third-party software used by its products.

Updates released by Juniper Networks for its Junos operating system patch several high and medium severity vulnerabilities. The company has also updated some of the third-party software used by its products.

Juniper Networks informed customers on Tuesday that it has launched an investigation into the new batch of exploits made public last week by the hacker group calling itself Shadow Brokers. The first round of files leaked by the Shadow Brokers in the summer of 2016 was found to contain some exploits targeting devices running Juniper’s ScreenOS.

Until it determines if any of its products are targeted by the newly released exploits, which are believed to have been used by the NSA-linked Equation Group, Juniper Networks has released updates that patch several vulnerabilities in the FreeBSD-based Junos OS.

The most severe of the flaws, based on its CVSS score, is CVE-2016-10142, an issue related to the IPv6 protocol specification, namely ICMP Packet Too Big (PTB) messages. The vulnerability can be exploited for denial-of-service (DoS) attacks.

Another high severity flaw is CVE-2016-1886, a keyboard driver buffer overflow that can be exploited to cause a DoS condition, read parts of the kernel memory, or execute arbitrary code.

It’s worth pointing out that CVE-2016-10142 and CVE-2016-1886 are not specific to Juniper products; the vulnerabilities are in FreeBSD and other Linux distributions.

The third high severity vulnerability is CVE-2017-2313, a DoS issue that affects some Junos systems when BGP is enabled.

Advertisement. Scroll to continue reading.

The medium severity weaknesses disclosed by the company this week are DoS flaws affecting various configurations. These security holes are tracked as CVE-2017-2313, CVE-2017-2312 and CVE-2017-2340.

Juniper is not aware of any instances where these vulnerabilities have been exploited for malicious purposes.

The vendor also announced patches for vulnerabilities affecting its NorthStar Controller application, and updates for the BIND and NTP components used by the company’s products. The NTP and BIND patches applied by Juniper were first made available several months ago, and other fixes have since been released for both NTP and BIND.

Related: Juniper Starts Fixing IPv6 Processing Vulnerability

Related: DoS Vulnerability Affects Cisco, Juniper Products

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.

Register

Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...