PT-2017-11415 · Juniper Networks · Junos

Publicado 2017-10-13 · Atualizado 2019-10-09 · CVE-2017-10620

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Junos OS versions 12.1X46 prior to 12.1X46-D71 Junos OS versions 12.3X48 prior to 12.3X48-D55 Junos OS versions 15.1X49 prior to 15.1X49-D110

Description The issue allows a man-in-the-middle attacker to inject bogus signatures, potentially causing service disruptions or preventing the device from detecting certain types of attacks, as Juniper Networks Junos OS on SRX series devices do not verify the HTTPS server certificate before downloading anti-virus updates.

Recommendations For Junos OS versions 12.1X46 prior to 12.1X46-D71, update to version 12.1X46-D71 or later. For Junos OS versions 12.3X48 prior to 12.3X48-D55, update to version 12.3X48-D55 or later. For Junos OS versions 15.1X49 prior to 15.1X49-D110, update to version 15.1X49-D110 or later.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2017-10620

Produtos afetados

Junos

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-10620 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-10620 · Aviso do Fabricante
• https://kb.juniper.net/JSA10822 · Aviso do Fabricante