Rewterz Threat Advisory – Multiple Juniper Networks Junos OS and Junos OS Evolved Vulnerabilities

April 13, 2023

Severity

Medium

Analysis Summary

CVE-2023-1697 CVSS:6.5

Juniper Networks Junos OS is vulnerable to a denial of service, caused by improper handling of missing values flaw in the Packet Forwarding Engine (PFE). By sending a specially crafted Ethernet frame, a remote attacker could exploit this vulnerability to cause the dcpfe process to crash, and results in a denial of service condition.

CVE-2023-28961 CVSS:5.8

Juniper Networks Junos OS could allow a remote attacker to bypass security restrictions, caused by an improper handling of unexpected data type flaw in IPv6 firewall filter processing. By sending specially crafted packets, an attacker could exploit this vulnerability to prevent a firewall filter with the term ‘from next-header ah’ from being properly installed in the packet forwarding engine (PFE).

CVE-2023-28962 CVSS:6.5

Juniper Networks Junos OS could allow a remote attacker to bypass security restrictions, caused by improper authentication validation in upload-file.php. By sending a specially crafted request, an attacker could exploit this vulnerability to upload arbitrary files to temporary folders on the device.

CVE-2023-28963 CVSS:5.3

Juniper Networks Junos OS could allow a remote attacker to obtain sensitive information, caused by improper authentication validation in cert-mgmt.php. By sending a specially crafted request, an attacker could exploit this vulnerability to read arbitrary files from temporary folders on the device, and use this information to launch further attacks against the affected system.

CVE-2023-28981 CVSS:7.5

Juniper Networks Junos OS and Junos OS Evolved are vulnerable to a denial of service, caused by a memory corruption flaw in the routing protocol daemon. By sending specially crafted IPv6 router advertisements, a remote attacker could exploit this vulnerability to cause the rpd process to crash, and results in a denial of service condition.

CVE-2023-28982 CVSS:7.5

Juniper Networks Junos OS and Junos OS Evolved are vulnerable to a denial of service, caused by a memory leak flaw in the routing protocol daemon. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause rpd memory usage increases over time, and results in a denial of service condition.

CVE-2023-28980 CVSS:5.5

Juniper Networks Junos OS and Junos OS Evolved are vulnerable to a denial of service, caused by a use-after-free flaw in the routing protocol daemon. By sending a specially crafted CLI command, a local authenticated attacker could exploit this vulnerability to cause the rpd process to crash, and results in a denial of service condition.

CVE-2023-28965 CVSS:6.2

Juniper Networks Junos OS is vulnerable to a denial of service, caused by an improper check or handling of exceptional conditions within the storm control feature. By sending a high rate of traffic, a remote attacker could exploit this vulnerability to cause a denial of service.

CVE-2023-28966 CVSS:7.8

Juniper Networks Junos OS Evolved could allow a local authenticated attacker to execute arbitrary commands on the system, caused by an incorrect default permissions vulnerability. By sending a specially crafted command, an attacker could exploit this vulnerability to execute arbitrary commands as root.