PT-2024-7844 · Juniper Networks · Junos Evolved

Published 2024-10-09 · Updated 2024-10-15 · CVE-2024-39544

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Junos OS Evolved versions prior to 20.4R3-S9-EVO Junos OS Evolved version 21.2-EVO prior to 21.2R3-S7-EVO Junos OS Evolved version 21.4-EVO prior to 21.4R3-S5-EVO Junos OS Evolved version 22.1-EVO prior to 22.1R3-S5-EVO Junos OS Evolved version 22.2-EVO prior to 22.2R3-S3-EVO Junos OS Evolved version 22.3-EVO prior to 22.3R3-EVO, 22.3R3-S2-EVO Junos OS Evolved version 22.4-EVO prior to 22.4R3-EVO Junos OS Evolved version 23.2-EVO prior to 23.2R1-S2-EVO, 23.2R2-EVO

Description The issue is related to incorrect default permissions in the command line interface (CLI) of Juniper Networks Junos OS Evolved, allowing a low-privileged local attacker to view sensitive information, such as NETCONF traceoptions files. This represents an exposure of sensitive information and compromises the confidentiality of the system.

Recommendations For Junos OS Evolved versions prior to 20.4R3-S9-EVO, update to version 20.4R3-S9-EVO or later. For Junos OS Evolved version 21.2-EVO prior to 21.2R3-S7-EVO, update to version 21.2R3-S7-EVO or later. For Junos OS Evolved version 21.4-EVO prior to 21.4R3-S5-EVO, update to version 21.4R3-S5-EVO or later. For Junos OS Evolved version 22.1-EVO prior to 22.1R3-S5-EVO, update to version 22.1R3-S5-EVO or later. For Junos OS Evolved version 22.2-EVO prior to 22.2R3-S3-EVO, update to version 22.2R3-S3-EVO or later. For Junos OS Evolved version 22.3-EVO prior to 22.3R3-EVO, 22.3R3-S2-EVO, update to version 22.3R3-EVO, 22.3R3-S2-EVO or later. For Junos OS Evolved version 22.4-EVO prior to 22.4R3-EVO, update to version 22.4R3-EVO or later. For Junos OS Evolved version 23.2-EVO prior to 23.2R1-S2-EVO, 23.2R2-EVO, update to version 23.2R1-S2-EVO, 23.2R2-EVO or later.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2024-09345

CVE-2024-39544

Affected Products

Junos Evolved

References · 14

• https://supportportal.juniper.net/JSA88106 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09345 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-39544 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39544 · Vendor Advisory
• https://twitter.com/transilienceai/status/1845874973640216689 · Twitter Post
• https://twitter.com/transilienceai/status/1845875059531083825 · Twitter Post
• https://twitter.com/transilienceai/status/1845875049355792726 · Twitter Post
• https://twitter.com/transilienceai/status/1845874988320166019 · Twitter Post
• https://twitter.com/transilienceai/status/1845875036361719884 · Twitter Post
• https://twitter.com/transilienceai/status/1845875007928652103 · Twitter Post
• https://vuldb.com/?id.280080 · Note
• https://twitter.com/transilienceai/status/1845874964450451839 · Twitter Post
• https://twitter.com/transilienceai/status/1845874997983957122 · Twitter Post
• https://twitter.com/transilienceai/status/1845875015675531745 · Twitter Post