PT-2020-7862 · Juniper Networks · Srx+1

Published 2020-02-28 · Updated 2023-03-01 · CVE-2015-5361

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SRX (affected versions not specified)

Description: The issue arises from the ftps-extensions option, which is disabled by default. This option is intended to provide functionality similar to regular, unencrypted FTP traffic when the SRX secures the FTP/FTPS client. However, when the SRX secures the FTPS server, the ftps-extensions option can allow an FTPS client temporary access to all TCP ports on the FTPS server. The data session is associated with the control channel and will be closed when the control channel session closes. Depending on the configuration of the FTPS server, supporting load-balancer, and SRX inactivity-timeout values, the server/load-balancer and SRX may keep the control channel open for an extended period, allowing an FTPS client access for an equal duration.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2015-5361

Affected Products

Junos

Srx

References · 5

• https://kb.juniper.net/JSA10706 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5361 · Security Note
• https://t.me/cvenotify/1302 · Telegram Post
• https://t.me/cibsecurity/10193 · Telegram Post
• https://t.me/cvenotify/45281 · Telegram Post