Multiples vulnerabilidades Junos OS
Múltiples vulnerabilidades en el componente J-Web de Juniper Networks Junos OS en las series SRX y EX
se han resuelto mediante la aplicación de correcciones específicas para abordar cada vulnerabilidad.
Al realizar la explotación de estas vulnerabilidades, un atacante no autenticado puede ejecutar código
malicioso de forma remota en los dispositivos con versiones vulnerables que no hay sido actualizados.
Las vulnerabilidades que se resuelven con las actualizaciones son las siguientes:
| CVE | CVSS | Summary |
|---|---|---|
| CVE-2023-36844 | 5.3 (CVSS:3.1/ AV:N/AC:L/ PR:N/UI:N/S:U/ C:N/I:L/A:N) |
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environments variables. Utilizing a crafted request an attacker is able to modify certain PHP environments variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities. |
| CVE-2023-36845 | 5.3 (CVSS:3.1/ AV:N/AC:L/ PR:N/UI:N/S:U/ C:N/I:L/A:N) |
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain, important environments variables. Utilizing a crafted request an attacker is able to modify a certain PHP environment variable leading to partial loss of integrity, which may allow chaining to other vulnerabilities. |
| CVE-2023-36846 | 5.3 (CVSS:3.1/ AV:N/AC:L/ PR:N/UI:N/S:U/ C:N/I:L/A:N) |
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. |
| CVE-2023-36847 | 5.3 (CVSS:3.1/ AV:N/AC:L/ PR:N/UI:N/S:U/ C:N/I:L/A:N) |
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. |
Versiones Afectadas
Estos problemas afectan a todas las versiones de Junos OS en las series SRX y EX.
Juniper Networks Junos OS on SRX Series
• Todas las versiones anteriores a 20.4R3-S8
• Versiones 21.2 anteriores a 21.2R3-S6
• Versiones 21.3 anteriores a 21.3R3-S5
• Versiones 21.4 anteriores a 21.4R3-S5
• Versiones 22.1 anteriores a 22.1R3-S3
• Versiones 22.2 anteriores a 22.2R3-S2
• Versiones 22.3 anteriores a 22.3R2-S2, 22.3R3
• Versiones 22.4 anteriores a 22.4R2-S1, 22.4R3
Juniper Networks Junos OS on EX Series
• Todas las versiones anteriores a 20.4R3-S8
• Versiones 21.2 anteriores a 21.2R3-S6
• Versiones 21.3 anteriores a 21.3R3-S5
• Versiones 21.4 anteriores a 21.4R3-S4
• Versiones 22.1 anteriores a 22.1R3-S3
• Versiones 22.2 anteriores a 22.2R3-S1
• Versiones 22.3 anteriores a 22.3R2-S2, 22.3R3
• Versiones 22.4 anteriores a 22.4R2-S1, 22.4R3
Recomendaciones
Para evitar la ejecución remota de código (RCE), solo es necesario reparar un PR por plataforma.
Para la serie EX, las siguientes versiones han resuelto esto a través de PR 1735387: 20.4R3-S8, 21.2R3-S6,
21.3R3-S5*, 21.4R3-S4, 22.1R3-S3, 22.2R3-S1, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3*, 23.2R1 y todas
las versiones posteriores.
Para la serie SRX, las siguientes versiones han resuelto esto mediante PR 1735389: 20.4R3-S8, 21.2R3-S6,
21.3R3-S5*, 21.4R3-S5*, 22.1R3-S3, 22.2R3-S2*, 22.3R2- S2, 22.3R3, 22.4R2-S1, 22.4R3*, 23.2R1 y todas
las versiones posteriores.
Deshabilite J-Web o limite el acceso solo a hosts confiables.
Nota: Estos problemas se rastrean como 1735387, 1735389, 1736942 y 1736937.
Referencias
https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiplevulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US
