PT-2021-12957 · Juniper Networks · Junos

Published 2021-04-22 · Updated 2021-04-27 · CVE-2021-0246

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions 18.3R1 through 18.3R2 on SRX1500, SRX4100, SRX4200, SRX4600, SRX5000 Series with SPC2 Juniper Networks Junos OS versions 18.4R1 through 18.4R1 on SRX1500, SRX4100, SRX4200, SRX4600, SRX5000 Series with SPC2/SPC3 Juniper Networks Junos OS versions 19.1R1 through 19.1R1 on SRX1500, SRX4100, SRX4200, SRX4600, SRX5000 Series with SPC2/SPC3

Description: The issue arises from incorrect default permissions assigned to tenant system administrators, allowing them to inadvertently send their network traffic to other tenants and modify overall device system traffic management. This can also cause a tenant to receive traffic from another tenant.

Recommendations: For Juniper Networks Junos OS versions 18.3R1 through 18.3R2, update to version 18.3R3 or later. For Juniper Networks Junos OS versions 18.4R1, update to version 18.4R2 or later. For Juniper Networks Junos OS versions 19.1R1, update to version 19.1R2 or later.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2021-0246

Affected Products

Junos

References · 3

• https://kb.juniper.net/JSA11139 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-0246 · Security Note
• https://osv.dev/vulnerability/CVE-2021-0246 · Vendor Advisory