Vulnerabilidades

*** Pendiente de traducción *** Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users with PFS access to inject arbitrary script payloads by supplying malicious HTML in the ntitle parameter processed through the TXT filter in pfs.main.php. Attackers can create a folder with a crafted title containing script tags that are stored unescaped in the database and execute in the browser of any user who views the folder listing, including administrators.

*** Pendiente de traducción *** An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on MX Series allows adjacent subscribers to bypass configured firewall filters.<br /> <br /> On MX Series devices with MPC10/11, LC4800/9600, and MX304 with subscribers configured on static interfaces, ingress firewall filters are not enforced, so that neither protocol level nor upstream bandwidth limitation are in effect. <br /> <br /> <br /> This issue affects Junos OS on MX with MPC10/11, LC4800/9600/4802, and MX304:<br /> <br /> <br /> * 23.2 versions from 23.2R2-S1 before 23.2R2-S7,<br /> * 23.4 versions from 23.4R2 before 23.4R2-S7,<br /> * 24.2 versions before 24.2R2-S3,<br /> * 24.4 versions before 24.4R2-S2,<br /> * 25.2 versions before 25.2R2.

*** Pendiente de traducción *** A Concurrent Execution using Shared Resource with Improper Synchronization (&amp;#39;Race Condition&amp;#39;) vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).<br /> <br /> As part of the stateful traffic processing on SRX Series devices flows are being established, and removed when not needed anymore. During the removal process the timeout of a flow should be set to 3 seconds and consequentially the flow should be removed shortly after. Due to a race condition occurring when setting the timeout there is a chance (the exact conditions are outside the attackers control) that the timeout is instead set to a very high value of larger than 10,000 seconds:<br /> <br /> <br /> <br /> user@host&gt; show security flow session | match timeout<br /> Session ID: 98784248524, Policy name: PROD-FLOW/4, HA State: Active, Timeout: 85250, Session State: Valid<br /> <br /> This will lead to an accumulation of flows which can be observed by an ever-increasing value of invalidated sessions in the output of &amp;#39;show security flow session summary&amp;#39;:<br /> <br /> user@host&gt; show security flow session summary | match invalid<br /> Invalidated sessions: 216931These sessions can&amp;#39;t be cleared manually with the &amp;#39;clear security flow session&amp;#39; command, which will either lead to forwarding to stop (and the system needs to be manually recovered with a reboot) or to a flowd core and automatic reboot.<br /> <br /> <br /> This issue affects Junos OS on SRX Series:<br /> <br /> <br /> * 24.2 versions before 24.2R2-S3,<br /> * 24.4 versions before 24.4R2-S1, 24.4R2-S2,<br /> * 25.2 versions before 25.2R1-S2, 25.2R2.<br /> <br /> <br /> <br /> <br /> This issue does not affect releases earlier than 24.2R1;

*** Pendiente de traducción *** A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series allows an adjacent, unauthenticated attacker to cause a Denial-of-Service (DoS).<br /> <br /> <br /> When the reachability of an sFlow collector changes, the corresponding next-hop entry is updated. If this update occurs simultaneously with the sFlow thread accessing the next-hop data (which is outside the attackers control), it causes the evo-pfemand process to crash, impacting all traffic forwarding until the automatic process restart has completed.<br /> <br /> <br /> <br /> <br /> This issue affects Junos OS Evolved on QFX Series:<br /> <br /> <br /> * all 23.2 versions, <br /> * 23.4 versions before 23.4R2-S7-EVO,<br /> * 24.2 versions before 24.2R2-S5-EVO,<br /> * 24.4 versions before 24.4R2-S3-EVO,<br /> * 25.2 versions before 25.2R2-EVO.

*** Pendiente de traducción *** An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause license exhaustion.<br /> <br /> <br /> Due to an incorrect initialization, a process which should only be able to communicate internally within the device, can be reached over the network via an open port. This leads to unauthorized access to the license management.<br /> <br /> This issue affects all Junos OS Evolved versions before 23.2R2-EVO.

*** Pendiente de traducción *** A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series devices allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS).When sFlow is configured in a Virtual Chassis (VC) scenario with EX4100 Series or EX4400 Series devices, multicast traffic which is received on one VC member and sent out on another member leads to a memory leak and ultimately an FPC crash and restart.<br /> <br /> The leak can be monitored by watching the continuous increase of the buffer values in the output of:<br /> <br /> user@host&gt; show chassis fpc <br /> This issue affects Junos OS on EX4100 Series and EX4400:<br /> <br /> <br /> * all versions before 23.2R2-S7,<br /> * 23.4 versions before 23.4R2-S7,<br /> * 24.2 versions before 24.2R2-S4,<br /> * 24.4 versions before 24.4R2.

*** Pendiente de traducción *** A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privilged attacker to cause a Denial-of-Service (DoS).<br /> <br /> On EX Series, QFX Series and MX Series a low-privileged attacker issuing a specific &amp;#39;show l2-learning&amp;#39; or &amp;#39;show ethernet-switching&amp;#39; command will cause an l2ald crash which will lead to a temporary service impact for all layer 2 services until the process has automatically restarted.<br /> <br /> This issue affects EX Series, QFX Series, MX Series:<br /> Junos OS:<br /> <br /> <br /> * all versions before 23.2R2-S7,<br /> * 23.4 versions before 23.4R2-S7,<br /> * 24.2 versions before 24.2R2,<br /> * 24.4 versions before 24.4R1-S2.<br /> <br /> <br /> <br /> Junos OS Evolved:<br /> * all versions before 23.2R2-S7-EVO,<br /> * 23.4 versions before 23.4R2-S8-EVO,<br /> * 24.2 versions before 24.2R2-EVO,<br /> * 24.4 versions before 24.4R1-S3-EVO.

*** Pendiente de traducción *** An Out-of-bounds Write vulnerability in the http-gatekeeper (http-gk) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).<br /> <br /> If an SRX Series device is configured for remote-access VPN with pre-logon compliance check, a network-based attacker sending specifically formatted requests can trigger an out of bounds write leading to an http-gk process crash. This crash leads to unavailability of all services depending on the [ system services web-management ] configuration (like J-Web, remote access VPN and firewall authentication) until the process automatically restarts.<br /> <br /> This issue affects Junos OS on SRX Series:<br /> <br /> <br /> * 23.2 versions before 23.2R2-S7,<br /> * 23.4 versions before 23.4R2-S8,<br /> * 24.2 versions before 24.2R2-S4,<br /> * 24.4 versions before 24.4R2-S4,<br /> * 25.2 versions before 25.2R2,<br /> * 25.4 versions before 25.4R1-S1, 25.4R2.

*** Pendiente de traducción *** An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).<br /> <br /> When an affected device initiates a TCP connection to an attacker-controlled system that responds with a specific packet, this causes a PFE crash and restart, which affects all services until the system has automatically recovered.<br /> This issue can happen among others in the following scenarios: ALG, SSL proxy, UTM, RTLOG, AppQoE probing, AAMW, ICAP, URL filtering.<br /> <br /> This issue affects Junos OS on MX Series with SPC3, SRX5k Series with SPC3, SRX1600 Series, SRX2300 Series, SRX4000 Series, and vSRX Series:<br /> <br /> * all versions before 23.2R2-S4,<br /> * 23.4 versions before 23.4R2-S5,<br /> * 24.2 versions before 24.2R2.

*** Pendiente de traducción *** An Improper Validation of Syntactic Correctness of Input vulnerability in the SIP plugin of Juniper Networks Junos OS on MX Series with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).If the SIP ALG is enabled on an affected device, the processing of a malformed SIP invite packet will cause a flow processing daemon (flowd) crash and restart. This leads to a complete service outage until the system has automatically recovered.<br /> <br /> <br /> <br /> This issue affects Junos OS on MX Series with SPC3 and SRX Series:<br /> <br /> <br /> * all versions before 23.2R2-S7,<br /> * 23.4 versions before 23.4R2-S8,<br /> * 24.2 versions before 24.2R2-S5,<br /> * 24.4 versions before 24.4R2-S4,<br /> * 25.2 versions before 25.2R2,<br /> * 25.4 versions before 25.4R1-S2.

*** Pendiente de traducción *** A Use of Multiple Resources with Duplicate Identifier vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).<br /> <br /> <br /> <br /> On an MX with SPC3 and SRX devices configured for VPN service, when a large number of VPN negotiations fail a peer index rollover will eventually occur. As a result, new peers are assigned index values that are already in use and the iked process starts to crash repeatedly. This results in failure to establish new VPN connections and rekeying existing ones. To restore service the system must be rebooted.<br /> Please note that the index value can&amp;#39;t be monitored, so customers should monitor tunnel up and down events and if a lot of events occur over an extended period of time it becomes likely that this issue occurs.<br /> <br /> To be exposed to this issue the system needs to run iked (vs. kmd which is not affected), which can be verified with:<br /> <br /> user@host&gt; show system processes extensive | match "KMD|IKED"<br /> This issue affects Junos OS on MX with SPC3, SRX Series:<br /> <br /> <br /> * all versions before 23.2R2-S7,<br /> * 23.4 versions before 23.4R2-S6,<br /> * 24.2 versions before 24.2R2-S3,<br /> * 24.4 versions before 24.4R2-S4,<br /> * 25.2 versions before 25.2R1-S1.

*** Pendiente de traducción *** An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial of Service (DoS).<br /> <br /> When TCP proxy is engaged in a flow session, to support ALGs, Advanced Anti-Malware, ICAP or UTM, a TCP packet with specifically malformed TCP header will cause flow processing daemon (flowd) to crash and restart. This causes a complete service outage until the system has automatically recovered.<br /> <br /> <br /> <br /> This issue affects Junos OS on MX with SPC3, and SRX Series: <br /> <br /> <br /> <br /> * 23.4 versions before 23.4R2-S7, <br /> * 24.2 versions before 24.2R2-S4, <br /> * 24.4 versions before 24.4R2-S3,<br /> * 25.2 versions before 25.2R2.<br /> <br /> <br /> <br /> <br /> This issue does not affect releases before 23.4R1.