PT-2017-11399 · Juniper Networks · Junos

Published 2017-07-14 · Updated 2019-10-09 · CVE-2017-10601

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Junos OS versions prior to 12.3R10 Junos OS versions 12.3X48 prior to 12.3X48-D20 Junos OS versions 13.2 prior to 13.2R8 Junos OS versions 13.3 prior to 13.3R7 Junos OS versions 14.1 prior to 14.1R4-S12 Junos OS versions 14.1 prior to 14.1R5 Junos OS versions 14.1 prior to 14.1R6 Junos OS versions 14.1X53 prior to 14.1X53-D30 Junos OS versions 14.2 prior to 14.2R4 Junos OS versions 15.1 prior to 15.1F2 Junos OS versions 15.1 prior to 15.1F3 Junos OS versions 15.1 prior to 15.1R2

Description A specific device configuration can result in a commit failure condition, allowing a user to log in without being prompted for a password when trying to login through console, ssh, ftp, telnet, or su. This issue relies on a device configuration precondition and typically occurs after a trusted administrative change to the system's running configuration. Error messages such as "mgd: error: commit failed: (statements constraint check failed)" and "Warning: Commit failed, activating partial configuration" may be seen when this failure occurs.

Recommendations For Junos OS versions prior to 12.3R10, update to 12.3R10 or later. For Junos OS versions 12.3X48 prior to 12.3X48-D20, update to 12.3X48-D20 or later. For Junos OS versions 13.2 prior to 13.2R8, update to 13.2R8 or later. For Junos OS versions 13.3 prior to 13.3R7, update to 13.3R7 or later. For Junos OS versions 14.1 prior to 14.1R4-S12, update to 14.1R4-S12 or later. For Junos OS versions 14.1 prior to 14.1R5, update to 14.1R5 or later. For Junos OS versions 14.1 prior to 14.1R6, update to 14.1R6 or later. For Junos OS versions 14.1X53 prior to 14.1X53-D30, update to 14.1X53-D30 or later. For Junos OS versions 14.2 prior to 14.2R4, update to 14.2R4 or later. For Junos OS versions 15.1 prior to 15.1F2, update to 15.1F2 or later. For Junos OS versions 15.1 prior to 15.1F3, update to 15.1F3 or later. For Junos OS versions 15.1 prior to 15.1R2, update to 15.1R2 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-10601

Affected Products

Junos

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-10601 · Security Note
• https://osv.dev/vulnerability/CVE-2017-10601 · Vendor Advisory
• https://kb.juniper.net/JSA10802 · Vendor Advisory
• http://securitytracker.com/id/1038902 · Note