Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Network Security

Juniper Patches Serious Flaws in Junos OS

Juniper Networks this week informed customers that its Junos operating system is affected by many serious vulnerabilities, including a flaw that may have been triggered during malicious network probing.

Juniper Networks this week informed customers that its Junos operating system is affected by many serious vulnerabilities, including a flaw that may have been triggered during malicious network probing.

Juniper on Wednesday published nearly two dozen advisories describing security holes in Junos, the operating system that powers its networking and security products. The company has provided patches and mitigations for each of the vulnerabilities.

One of the more interesting issues is CVE-2018-0049, which allows an attacker to crash the Junos kernel by sending specially crafted MPLS packets. Juniper noted that a single packet can cause a denial-of-service (DoS) condition, but an attacker can launch a sustained DoS attack by continually sending malicious packets.

Juniper says that while it’s not aware of instances where this vulnerability was specifically targeted by hackers, the company is aware of “possible malicious network probing which may have triggered this issue.”

Juniper has assigned a “critical” risk level to several vulnerabilities affecting the NTP daemon. The Network Time Foundation recently patched several vulnerabilities, including ones rated “critical” and “high severity,” and Juniper has now rolled out the fixes to its customers with Junos OS updates.

Juniper NFX series devices are affected by a critical flaw that can allow a remote attacker to gain access to the system through accounts with blank passwords. The company addressed the issue by not allowing empty passwords.

The list of Junos vulnerabilities that are close to critical – with a CVSS score of 8.8 – includes two vulnerabilities that can be exploited to crash the routing protocol daemon (RPD) and possibly for remote code execution.

Juniper has also disclosed the existence of several other severe RPD-related vulnerabilities that can be exploited to cause a DoS condition.

Advertisement. Scroll to continue reading.

An update for the Junos Space Network Management Platform fixes several vulnerabilities, including ones considered “high risk.”

Another serious DoS vulnerability has been found in the SIP application layer gateway (ALG) in Junos, which allows an attacker to crash various processes.

A “high risk” rating has also been assigned to a vulnerability in the RSH service that allows a remote and unauthenticated attacker to gain root access to affected devices.

A dozen of the advisories published this week by Juniper describe “medium risk” flaws that can be exploited for DoS and cross-site scripting (XSS) attacks.

Related: DoS Vulnerability Affects Cisco, Juniper Products

Related: Cisco Patches Serious Flaws in RV, SD-WAN, Umbrella Products

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this event as we dive into threat hunting tools and frameworks, and explore value of threat intelligence data in the defender’s security stack.

Register

Learn how integrating BAS and Automated Penetration Testing empowers security teams to quickly identify and validate threats, enabling prompt response and remediation.

Register

People on the Move

Shane Barney has been appointed CISO of password management and PAM solutions provider Keeper Security.

Edge Delta has appointed Joan Pepin as its Chief Information Security Officer.

Vats Srivatsan has been appointed interim CEO of WatchGuard after Prakash Panjwani stepped down.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.