Juniper Patches Serious Flaws in Junos OS
12.10.2018 securityweek Vulnerebility

Juniper Networks this week informed customers that its Junos operating system is affected by many serious vulnerabilities, including a flaw that may have been triggered during malicious network probing.

Juniper on Wednesday published nearly two dozen advisories describing security holes in Junos, the operating system that powers its networking and security products. The company has provided patches and mitigations for each of the vulnerabilities.

One of the more interesting issues is CVE-2018-0049, which allows an attacker to crash the Junos kernel by sending specially crafted MPLS packets. Juniper noted that a single packet can cause a denial-of-service (DoS) condition, but an attacker can launch a sustained DoS attack by continually sending malicious packets.

Juniper says that while it's not aware of instances where this vulnerability was specifically targeted by hackers, the company is aware of "possible malicious network probing which may have triggered this issue."

Juniper has assigned a "critical" risk level to several vulnerabilities affecting the NTP daemon. The Network Time Foundation recently patched several vulnerabilities, including ones rated "critical" and "high severity," and Juniper has now rolled out the fixes to its customers with Junos OS updates.

Juniper NFX series devices are affected by a critical flaw that can allow a remote attacker to gain access to the system through accounts with blank passwords. The company addressed the issue by not allowing empty passwords.

The list of Junos vulnerabilities that are close to critical – with a CVSS score of 8.8 – includes two vulnerabilities that can be exploited to crash the routing protocol daemon (RPD) and possibly for remote code execution.

Juniper has also disclosed the existence of several other severe RPD-related vulnerabilities that can be exploited to cause a DoS condition.

An update for the Junos Space Network Management Platform fixes several vulnerabilities, including ones considered "high risk."

Another serious DoS vulnerability has been found in the SIP application layer gateway (ALG) in Junos, which allows an attacker to crash various processes.

A "high risk" rating has also been assigned to a vulnerability in the RSH service that allows a remote and unauthenticated attacker to gain root access to affected devices.

A dozen of the advisories published this week by Juniper describe "medium risk" flaws that can be exploited for DoS and cross-site scripting (XSS) attacks.