Home Tags Juniper

Tag: juniper

Monster patch day for Juniper customers

Nine advisories landed today Clear the diaries, Juniper sysadmins, a van-load of patches landed today.…

Juniper Discusses The New Network & How To Secure It

At RSA, Mihir Maniar, Juniper Networks' vice president of security products and strategy, and Laurence Pitt, Juniper Networks' EMEA security strategy director, discuss how the network has not disappeared, it's just become more elastic.

HP patents, sold off to a troll, are used to sue...

Patents went from 3Com to HP to East Texas-based Plectrum LLC.

JSA10773 – 2017-01 Security Bulletin: QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and...

2017-01 Security Bulletin: QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600: 'Etherleak' memory disclosure in Ethernet padding data (CVE-2017-2304)Product Affected:This issue affects QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices. Problem: QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices do not pad Ethernet packets with zeros, and thus some packets can contain fragments of system memory or data from previous packets.

This issue is also known as 'Etherleak' and often detected as CVE-2003-0001. Juniper SIRT is not aware of any malicious exploitation of this vulnerability. This issue has been assigned CVE-2017-2304. Solution: The following software releases have been updated to resolve this specific issue: Junos OS 14.1X53-D40, 15.1X53-D40, 15.1R2  and all subsequent releases. This issue is being tracked as PR 1063645 and is visible on the Customer Support website. KB16765 - "In which releases are vulnerabilities fixed?" describes which release vulnerabilities are fixed as per our End of Engineering and End of Life support policies. Workaround: There are no known workarounds to prevent the information leak in Ethernet packets. It is a good security practice to limit the exploitable attack surface of critical infrastructure networking equipment. Use access lists or firewall filters to limit access to the QFX device only from trusted, administrative networks or hosts. Implementation: Security vulnerabilities in Junos are fixed in the next available Maintenance Release of each supported Junos version.
In some cases, a Maintenance Release is not planned to be available in an appropriate time-frame.

For these cases, Service Releases are made available in order to be more timely.
Security Advisory and Security Notices will indicate which Maintenance and Service Releases contain fixes for the issues described. Upon request to JTAC, customers will be provided download instructions for a Service Release.

Although Juniper does not provide formal Release Note documentation for a Service Release, a list of "PRs fixed" can be provided on request. Modification History: 2017-01-11: Initial release. Related Links:CVSS Score:4.3 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Risk Level:Low Risk Assessment:Information for how Juniper Networks uses CVSS can be found at KB 16446 "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

JSA10770 – 2017-01 Security Bulletin: Junos Space: Multiple vulnerabilities resolved in...

CVE CVSS base score Summary CVE-2016-1762 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) The xmlNextChar function in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. CVE-2016-444...

JSA10768 – 2017-01 Security Bulletin: Junos: SRX Series denial of service...

2017-01 Security Bulletin: Junos: SRX Series denial of service vulnerability in flowd due to crafted multicast packets (CVE-2017-2300)Product Affected:This issue affects any SRX Series Services Gateway chassis cluster Problem:The flowd daemon on the primary node of an SRX Series chassis cluster may crash and restart when attempting to synchronize a multicast session created via crafted multicast packets.  Upon the flowd crash, data plane redundancy groups will fail over to the secondary node in the chassis cluster while flowd on the primary node restarts.This issue only occurs in chassis cluster configurations that process transit multicast traffic.  Transit multicast traffic is processed on an SRX services gateway by enabling PIM in normal Flow Mode, or via security policies permitting transit multicast traffic in L2/Transparent Mode.Juniper SIRT is not aware of any malicious exploitation of this vulnerability.No other Juniper Networks products or platforms are affected by this issue.This issue has been assigned CVE-2017-2300. Solution:The following software releases have been updated to resolve this specific issue: Junos OS 12.1X46-D65, 12.3X48-D40, 15.1X49-D60, and all subsequent releases.This issue is being tracked as PR 1188853 and is visible on the Customer Support website.KB16765 - "In which releases are vulnerabilities fixed?" describes which release vulnerabilities are fixed as per our End of Engineering and End of Life support policies. Workaround:Disallow transit multicast traffic, or isolate/disable the secondary node of the chassis cluster until an upgrade can be performed. For SRXs running in Transparent Mode, any security policies permitting transit multicast traffic should be disabled (default policy is deny-all). For SRXs running in normal Flow Mode, transit multicast traffic can also be stopped by disabling PIM protocol. Implementation:How to obtain fixed software:Security vulnerabilities in Junos are fixed in the next available Maintenance Release of each supported Junos version.
In some cases, a Maintenance Release is not planned to be available in an appropriate time-frame.

For these cases, Service Releases are made available in order to be more timely.
Security Advisory and Security Notices will indicate which Maintenance and Service Releases contain fixes for the issues described. Upon request to JTAC, customers will be provided download instructions for a Service Release.

Although Juniper does not provide formal Release Note documentation for a Service Release, a list of "PRs fixed" can be provided on request.Modification History: 2017-01-11: Initial publication2017-01-18: Devices with security policies permitting transit multicast traffic in Transparent Mode are also vulnerable Related Links:CVSS Score:6.5 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Risk Level:Medium Risk Assessment:Information for how Juniper Networks uses CVSS can be found at KB 16446 "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

JSA10774 – 2017-01 Security Bulletin: Network and Security Manager (NSM): Multiple...

CVE CVSS base score Summary CVE-2015-5600 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices withi...

JSA10771 – 2017-01 Security Bulletin: Junos: Denial of Service vulnerability in...

2017-01 Security Bulletin: Junos: Denial of Service vulnerability in RPD (CVE-2017-2302)Product Affected:This issue can affect any product or platform running Junos OS. Problem: On Junos OS devices where the BGP add-path feature is enabled with 'send' ...

JSA10774 – 2017-01 Security Bulletin: Network and Security Manager (NSM): Multiple...

2017-01 Security Bulletin: Network and Security Manager (NSM): Multiple OpenSSH vulnerabilities affect NSM Appliance OS.Product Affected:NSM Appliances (NSM3000, NSM4000 and NSMExpress). Problem: Multiple OpenSSH software vulnerabilities affect NSM App...

JSA10772 – 2017-01 Security Bulletin: Junos: RPD crash while processing RIP...

2017-01 Security Bulletin: Junos: RPD crash while processing RIP advertisements (CVE-2017-2303)Product Affected:This issue can affect any product or platform running Junos OS where RIP is enabled. Problem: Certain RIP advertisements received by the rou...

Juniper warns: Borked upgrade opens root on firewalls

Turn it off and turn it back on again. No, really Juniper is warning users of its SRX firewalls that a borked upgrade leaves a root-level account open to the world. Any users who issued the "request system software" command with the "partition" option are affected by the bug. In its first advisory for 2017, the Gin Palace explains the failed upgrade “can leave the system in a state where root CLI login is allowed without a password”.
It applies to any system upgraded from Junos OS prior to 12.1X46-D65. When the upgrade failed, the system reverted to a “safe mode” designed to make sure a sysadmin can get into the system to fix it – but in that mode, the only login available is root without a password. Other previously-valid authentication credentials are wiped. You may want to take a deep breath before reading the next bit: “Upgrading from an affected release to a fixed release will not resolve this issue.” The good news: “the symptoms are immediately obvious after an affected upgrade and may be remediated by rebooting the device post-upgrade”. In other words, try turning it off, and turning it back on again. ® Sponsored: Want to know more about Privileged Access Management? Visit The Register's hub

Attivo Networks Launches Inaugural Partner Program

As the market for deception technologies continues to gain steam, Attivo Networks is looking to further embrace the channel with the launch of its inaugural partner program, the company announced Thursday.

The new program, which has a single tier for authorized partners, includes sales incentives, training, enablement, marketing, deal registration and more.

The program is structured to build on five key pillars, John Quinn, vice president of worldwide channels, said: building a bidirectional relationship with partners, strong financial incentives, sales success, marketing, and training.

The ultimate goal, Quinn said, is to help partners build a relationship with customers that leverages the company's deception technology to fill security gaps, drive additional revenue through added product and services, and establish them as a stronger trusted advisor to their customers.

[Related: Security Expert On Presidential Election Hack: 'We Should Have Expected This For a Long Time']

"We want to make sure that the partner is front and center and highlighted as who is bringing this solution to the table and addressing this gap [in security] for the customer … That establishes them in a position to be able to really control that perceived value by the customer and maintain the highest level of profitability possible," Quinn said.

The program launch builds on a channel-centric legacy at Attivo Networks, CEO Tushar Kothari said. Kothari founded Attivo Networks, which sells a platform that uses deception technology to detect, investigate and help remediate attacks already inside the network. He founded the company in 2011 after spending many years in channel roles at Cisco, Juniper and Meru Networks.

"We can help partners be very successful and bring something that is important and of value … I'm very excited to have a chance to run a company and design the company myself around channel thinking … We are accelerating that with what we are announcing today."

Dave Glenn, executive vice president of business development at CBI, said seeing that kind of channel commitment with the new program is key, as the Detroit-based solution provider is extremely selective about who it chooses to partner with, as he estimated each added vendor partner amounts to a million-dollar investment.

"We figure to really bring on a partner, and especially in our world where we're not trying to boil the ocean and represent everyone … we want to make the right decision. We want to make sure it's the right technology and partner," Glenn said.

To evaluate a partner, Glenn said CBI uses a 40-point checklist that includes evaluating the technology, completeness of vision, implementation, professional services, integrations, and more.

The market for deception technology overall is new, but starting to take hold, Kothari said.

Gartner announced it would be starting to do research on the area this year and more enterprises looking to embrace the technology. Kothari said Attivo itself has seen "tremendous growth" over the past year, though could not disclose exact numbers.