PT-2020-5509 · Juniper Networks+1 · Srx Series+3

Published

2020-10-16

·

Updated

2022-01-01

·

CVE-2020-1688

CVSS v3.1

6.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS on SRX Series and NFX Series versions prior to 12.3X48-D105 Juniper Networks Junos OS on SRX Series and NFX Series versions prior to 15.1X49-D190 Juniper Networks Junos OS on SRX Series and NFX Series versions prior to 16.1R7-S8 Juniper Networks Junos OS on SRX Series and NFX Series versions prior to 17.2R3-S4 Juniper Networks Junos OS on SRX Series and NFX Series versions prior to 17.3R3-S8 Juniper Networks Junos OS on SRX Series and NFX Series versions prior to 17.4R2-S11 Juniper Networks Junos OS on SRX Series and NFX Series versions prior to 17.4R3 Juniper Networks Junos OS on SRX Series and NFX Series versions prior to 18.1R3-S7 Juniper Networks Junos OS on SRX Series and NFX Series versions prior to 18.2R3 Juniper Networks Junos OS on SRX Series and NFX Series versions prior to 18.3R2-S4 Juniper Networks Junos OS on SRX Series and NFX Series versions prior to 18.3R3 Juniper Networks Junos OS on SRX Series and NFX Series versions prior to 18.4R1-S7 Juniper Networks Junos OS on SRX Series and NFX Series versions prior to 18.4R2 Juniper Networks Junos OS on SRX Series and NFX Series versions prior to 19.1R2 Juniper Networks Junos OS on SRX Series and NFX Series versions prior to 19.2R1-S4 Juniper Networks Junos OS on SRX Series and NFX Series versions prior to 19.2R2
Description A local authenticated user with access to the shell may obtain the Web API service private key used for encrypted communication between the Juniper device and authenticator services. Exploitation of this issue may allow an attacker to decrypt communications between the Juniper device and the authenticator service. This Web API service is used for authentication services such as the Juniper Identity Management Service or the integrated ClearPass authentication and enforcement feature.
Recommendations For versions prior to 12.3X48-D105, update to 12.3X48-D105 or later. For versions prior to 15.1X49-D190, update to 15.1X49-D190 or later. For versions prior to 16.1R7-S8, update to 16.1R7-S8 or later. For versions prior to 17.2R3-S4, update to 17.2R3-S4 or later. For versions prior to 17.3R3-S8, update to 17.3R3-S8 or later. For versions prior to 17.4R2-S11, update to 17.4R2-S11 or later. For versions prior to 17.4R3, update to 17.4R3 or later. For versions prior to 18.1R3-S7, update to 18.1R3-S7 or later. For versions prior to 18.2R3, update to 18.2R3 or later. For versions prior to 18.3R2-S4, update to 18.3R2-S4 or later. For versions prior to 18.3R3, update to 18.3R3 or later. For versions prior to 18.4R1-S7, update to 18.4R1-S7 or later. For versions prior to 18.4R2, update to 18.4R2 or later. For versions prior to 19.1R2, update to 19.1R2 or later. For versions prior to 19.2R1-S4, update to 19.2R1-S4 or later. For versions prior to 19.2R2, update to 19.2R2 or later.

Fix

Missing Encryption of Sensitive Data

Insufficiently Protected Credentials

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-320CWE-311CWE-359CWE-522

Related Identifiers

BDU:2021-00981
CVE-2020-1688

Affected Products

Clearpass
Junos
Nfx Series
Srx Series