CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2024-39565 – Junos OS: J-Web: An unauthenticated, network-based attacker can perform XPATH injection attack against a device.
https://notcve.org/view.php?id=CVE-2024-39565
An Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in J-Web shipped with Juniper Networks Junos OS allows an unauthenticated, network-based attacker to execute remote commands on the target device. While an administrator is logged into a J-Web session or has previously logged in and subsequently logged out of their J-Web session, the attacker can arbitrarily execute commands on the target device with the other user's credentials. In the worst case, the attacker will have full control over the device. This issue affects Junos OS: * All versions before 21.2R3-S8, * from 21.4 before 21.4R3-S7, * from 22.2 before 22.2R3-S4, * from 22.3 before 22.3R3-S3, * from 22.4 before 22.4R3-S2, * from 23.2 before 23.2R2, * from 23.4 before 23.4R1-S1, 23.4R2. Una vulnerabilidad de neutralización inadecuada de datos dentro de expresiones XPath ('inyección XPath') en J-Web incluido con Juniper Networks Junos OS permite que un atacante basado en red no autenticado ejecute comandos remotos en el dispositivo objetivo. Mientras un administrador inicia sesión en una sesión de J-Web o ha iniciado sesión previamente y posteriormente ha cerrado sesión en su sesión de J-Web, el atacante puede ejecutar comandos arbitrariamente en el dispositivo de destino con las credenciales del otro usuario. En el peor de los casos, el atacante tendrá control total sobre el dispositivo. • https://support.juniper.net/support/downloads/?p=283 https://supportportal.juniper.net/JSA83023 https://www.first.org/cvss/calculator/v4-0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/AU:Y/R:I/V:C/RE:L/U:Amber • CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection') •
CVSS: 8.7EPSS: 0%CPEs: 5EXPL: 0CVE-2024-39562 – Junos OS Evolved: A high rate of SSH connections causes a Denial of Service
https://notcve.org/view.php?id=CVE-2024-39562
A Missing Release of Resource after Effective Lifetime vulnerability the xinetd process, responsible for spawning SSH daemon (sshd) instances, of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to cause a Denial of Service (DoS) by blocking SSH access for legitimate users. Continued receipt of these connections will create a sustained Denial of Service (DoS) condition. The issue is triggered when a high rate of concurrent SSH requests are received and terminated in a specific way, causing xinetd to crash, and leaving defunct sshd processes. Successful exploitation of this vulnerability blocks both SSH access as well as services which rely upon SSH, such as SFTP, and Netconf over SSH. Once the system is in this state, legitimate users will be unable to SSH to the device until service is manually restored. See WORKAROUND section below. Administrators can monitor an increase in defunct sshd processes by utilizing the CLI command: > show system processes | match sshd root 25219 30901 0 Jul16 ? 00:00:00 [sshd] <defunct> This issue affects Juniper Networks Junos OS Evolved: * All versions prior to 21.4R3-S7-EVO * 22.3-EVO versions prior to 22.3R2-S2-EVO, 22.3R3-S2-EVO; * 22.4-EVO versions prior to 22.4R3-EVO; * 23.2-EVO versions prior to 23.2R2-EVO. This issue does not affect Juniper Networks Junos OS Evolved 22.1-EVO nor 22.2-EVO. • https://supportportal.juniper.net/JSA75724 https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 6.9EPSS: 0%CPEs: 9EXPL: 0CVE-2024-39561 – Junos OS: SRX4600, SRX5000 Series: TCP packets with SYN/FIN or SYN/RST are transferred after enabling no-syn-check with Express Path
https://notcve.org/view.php?id=CVE-2024-39561
An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow daemon (flowd) of Juniper Networks Junos OS on SRX4600 and SRX5000 Series allows an attacker to send TCP packets with SYN/FIN or SYN/RST flags, bypassing the expected blocking of these packets. A TCP packet with SYN/FIN or SYN/RST should be dropped in flowd. However, when no-syn-check and Express Path are enabled, these TCP packets are unexpectedly transferred to the downstream network. This issue affects Junos OS on SRX4600 and SRX5000 Series: * All versions before 21.2R3-S8, * from 21.4 before 21.4R3-S7, * from 22.1 before 22.1R3-S6, * from 22.2 before 22.2R3-S4, * from 22.3 before 22.3R3-S3, * from 22.4 before 22.4R3-S2, * from 23.2 before 23.2R2, * from 23.4 before 23.4R1-S1, 23.4R2. Una vulnerabilidad de verificación inadecuada de condiciones inusuales o excepcionales en el demonio de flujo (flowd) de Juniper Networks Junos OS en las series SRX4600 y SRX5000 permite a un atacante enviar paquetes TCP con indicadores SYN/FIN o SYN/RST, evitando el bloqueo esperado de estos paquetes. . Un paquete TCP con SYN/FIN o SYN/RST debe descartarse en flowd. Sin embargo, cuando no-syn-check y Express Path están habilitados, estos paquetes TCP se transfieren inesperadamente a la red descendente. • https://supportportal.juniper.net/JSA83021 • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 7.1EPSS: 0%CPEs: 14EXPL: 0CVE-2024-39560 – Junos OS and Junos OS Evolved: Memory leak due to RSVP neighbor persistent error leading to kernel crash
https://notcve.org/view.php?id=CVE-2024-39560
An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a logically adjacent downstream RSVP neighbor to cause kernel memory exhaustion, leading to a kernel crash, resulting in a Denial of Service (DoS). The kernel memory leak and eventual crash will be seen when the downstream RSVP neighbor has a persistent error which will not be corrected. System kernel memory can be monitored through the use of the 'show system statistics kernel memory' command as shown below: user@router> show system statistics kernel memory Memory Size (kB) Percentage When Active 753092 18.4% Now Inactive 574300 14.0% Now Wired 443236 10.8% Now Cached 1911204 46.6% Now Buf 32768 0.8% Now Free 385072 9.4% Now Kernel Memory Now Data 312908 7.6% Now Text 2560 0.1% Now ... This issue affects: Junos OS: * All versions before 20.4R3-S9, * from 21.4 before 21.4R3-S5, * from 22.1 before 22.1R3-S5, * from 22.2 before 22.2R3-S3, * from 22.3 before 22.3R3-S2, * from 22.4 before 22.4R3, * from 23.2 before 23.2R2; Junos OS Evolved: * All versions before 21.4R3-S5-EVO, * from 22.1-EVO before 22.1R3-S5-EVO, * from 22.2-EVO before 22.2R3-S3-EVO, * from 22.3-EVO before 22.3R3-S2-EVO, * from 22.4-EVO before 22.4R3-EVO, * from 23.2-EVO before 23.2R2-EVO. Una vulnerabilidad de manejo inadecuado de condiciones excepcionales en el daemon del protocolo de enrutamiento (rpd) de Juniper Networks Junos OS y Junos OS Evolved permite que un vecino RSVP descendente lógicamente adyacente provoque el agotamiento de la memoria del kernel, lo que provoca un fallo del kernel, lo que resulta en una denegación de servicio ( DoS). La pérdida de memoria del kernel y su eventual fallo se verán cuando el vecino RSVP descendente tenga un error persistente que no se corregirá. La memoria del kernel del sistema se puede monitorear mediante el uso del comando 'mostrar la memoria del kernel de estadísticas del sistema' como se muestra a continuación: usuario@router> mostrar la memoria del kernel de estadísticas del sistema Tamaño de la memoria (kB) Porcentaje cuando está activo 753092 18,4 % ahora inactivo 574300 14,0 % ahora cableado 443236 10,8% Ahora en caché 1911204 46,6% Ahora Buf 32768 0,8% Ahora gratis 385072 9,4% Ahora Memoria del kernel Ahora Datos 312908 7,6% Ahora Texto 2560 0,1% Ahora... Este problema afecta a: Junos OS: * Todas las versiones anteriores a 20.4R3-S9 , * desde 21.4 antes de 21.4R3-S5, * desde 22.1 antes de 22.1R3-S5, * desde 22.2 antes de 22.2R3-S3, * desde 22.3 antes de 22.3R3-S2, * desde 22.4 antes de 22.4R3, * desde 23.2 antes de 23.2R2 ; Junos OS Evolved: * Todas las versiones anteriores a 21.4R3-S5-EVO, * desde 22.1-EVO antes de 22.1R3-S5-EVO, * desde 22.2-EVO antes de 22.2R3-S3-EVO, * desde 22.3-EVO antes de 22.3R3- S2-EVO, * de 22.4-EVO antes de 22.4R3-EVO, * de 23.2-EVO antes de 23.2R2-EVO. • https://supportportal.juniper.net/JSA83020 • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 8.2EPSS: 0%CPEs: 7EXPL: 0CVE-2024-39559 – Junos OS Evolved: Receipt of a specific TCP packet may result in a system crash (vmcore) on dual RE systems with NSR enabled
https://notcve.org/view.php?id=CVE-2024-39559
An Improper Check for Unusual or Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS Evolved may allow a network-based unauthenticated attacker to crash the device (vmcore) by sending a specific TCP packet over an established TCP session with MD5 authentication enabled, destined to an accessible port on the device, resulting in a Denial of Service (DoS). The receipt of this packet must occur within a specific timing window outside the attacker's control (i.e., race condition). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. This issue only affects dual RE systems with Nonstop Active Routing (NSR) enabled. Exploitation can only occur over TCP sessions with MD5 authentication enabled (e.g., BGP with MD5 authentication). This issue affects Junos OS Evolved: * All versions before 21.2R3-S8-EVO, * from 21.4-EVO before 21.4R3-S6-EVO, * from 22.1-EVO before 22.1R3-S4-EVO, * from 22.2-EVO before 22.2R3-S4-EVO, * from 22.3-EVO before 22.3R3-S3-EVO, * from 22.4-EVO before 22.4R2-S2-EVO, 22.4R3-EVO. Una vulnerabilidad de verificación inadecuada de condiciones inusuales o excepcionales en el procesamiento de paquetes de Juniper Networks Junos OS Evolved puede permitir que un atacante no autenticado basado en red bloquee el dispositivo (vmcore) enviando un paquete TCP específico a través de una sesión TCP establecida con la autenticación MD5 habilitada, destinada a un puerto accesible en el dispositivo, lo que resulta en una Denegación de Servicio (DoS). La recepción de este paquete debe ocurrir dentro de una ventana de tiempo específica fuera del control del atacante (es decir, condición de ejecución). La recepción y procesamiento continuo de este paquete creará una condición sostenida de Denegación de Servicio (DoS). • https://supportportal.juniper.net/JSA83019 • CWE-754: Improper Check for Unusual or Exceptional Conditions •