PT-2020-14881 · Juniper Networks · Junos

Published 2020-10-16 · Updated 2020-10-27 · CVE-2020-1669

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS on NFX350 versions prior to 19.4R3 Juniper Networks Junos OS on NFX350 versions prior to 20.1R1-S4 Juniper Networks Junos OS on NFX350 versions prior to 20.1R2

Description The issue concerns the storage of password hashes in a world-readable file, /etc/passwd, within the Juniper Device Manager container. This practice allows an attacker with local filesystem access to potentially brute-force decrypt the stored password hashes.

Recommendations For versions prior to 19.4R3, update to 19.4R3 or later. For versions prior to 20.1R1-S4, update to 20.1R1-S4 or later. For versions prior to 20.1R2, update to 20.1R2 or later.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-256

CWE-522

Related Identifiers

CVE-2020-1669

Affected Products

Junos

References · 3

• https://osv.dev/vulnerability/CVE-2020-1669 · Vendor Advisory
• https://kb.juniper.net/JSA11066 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1669 · Security Note