PT-2020-4093 · Juniper Networks · Jatp+1

Published 2020-04-08 · Updated 2020-04-14 · CVE-2020-1616

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Juniper Networks JATP and vJATP versions prior to 5.0.6.0

Description: The issue is related to insufficient server-side login attempt limit enforcement in the SSH login service, allowing an unauthenticated, remote attacker to perform multiple login attempts in excess of the configured login attempt limit. This enables the attacker to perform brute-force password attacks on the SSH service.

Recommendations: For Juniper Networks JATP and vJATP versions prior to 5.0.6.0, update to version 5.0.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the SSH service to minimize the risk of exploitation.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

BDU:2020-04493

CVE-2020-1616

Affected Products

Jatp

Vjatp

References · 7

• https://bdu.fstec.ru/vul/2020-04493 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-1616 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1616 · Vendor Advisory
• https://kb.juniper.net/JSA10999 · Vendor Advisory
• https://t.me/cvenotify/2587 · Telegram Post
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10999&cat=SIRT_1&actp=LIST · Note
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10999&cat=SIRT_1&actp=LIST · Note