Skip to content

Commit e33c844

Browse files
Dinindu-WickDGovEnterpriseadonm
authored
Juniper Junos OS EX / SRX vulnerabilities - 20231114002 (#409)
* T1566.001 - QR Code Phishing Attachment (Quishing) - Updated the KQL with Recipient Email address * # NSA, FBI, CISA, and Japanese Partners Release Advisory on PRC-Linked Cyber Actors - 20230928002 * Apple releases Critical Updates for Known Exploited vulnerabilities - 20231009003 * Apple releases Critical Updates for Known Exploited vulnerabilities - 20231009001 * Update T1566.001-QR-CodePhishingAttachment(Quishing).md Updated the document version number to 1.0 * Citrix Releases Security Updates for Multiple Products - 20231012001 * Updated Citrix Releases Security Updates for Multiple Products - 20231012001 * Updated Citrix Releases Security Updates for Multiple Products - 20231012001 * Added new ADS and updates * Updated Advisory number for Citrix advisory * Updated ADSs with macros for MITRE URL's * Updates libraries and requirement.txt * Removed macros for Software ID related ADS's * Added marcos to retrieve MITRE URL's * Updated requirements.txt with BeautifulSoup4 req * 20231023005-SolarWinds-ARM-ThreeCriticalRCEVulnerabilities.md * Guidance for Addressing Cisco IOS XE Web UI Vulnerabilities - 20231025001 * VMware vCenter Server updates address out-of-bounds write and information disclosure vulnerabilities - 20231026001 * Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature - 20231027004 * Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature - 20231027004 * Apple Releases Security Advisories for Multiple Products - 20231027005 * Updated CVSS score of CVE-2023-4966 - 20231012003 * Improper Authorization Vulnerability In Confluence Data Center and Server - 20231101002 * Added logic to resolve links to MITRE tactics * Added new ADS's and updated existing ones * Updated entry to hide Lateral Movement - Webservers in Guidelines table * New Microsoft Exchange zero-days allow RCE, data theft attacks - 20231106002 * Updated ADS formatting and KQL Syntax's * Updated ADS formatting and KQL Syntax's * Minor updates to formatting * updates to ads * Updates to ADS * Minor updates to ADS * Updated ADS * Updates to ADS * Updated ADS * Minor updates to ADS's * Updates to ADSs * Atlassian Confluence Data Center and Server Improper Authorization Vulnerability - 20231108001 * Updated Linux Webshell indicator ADS * Updated the Technique ID in Linux Webshell Indicators * Juniper Junos OS EX / SRX vulnerabilities - 20231114002 --------- Co-authored-by: Joshua Hitchen (DGov) <[email protected]> Co-authored-by: Adon Metcalfe <[email protected]>
1 parent 0a6f99e commit e33c844

File tree

1 file changed

+59
-0
lines changed

1 file changed

+59
-0
lines changed

‎docs/advisories/20231114002-Juniper-Junos-OS-EX-SRX-vulnerabilities.md

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Juniper Junos OS EX / SRX vulnerabilities - 20231114002
2+
## Overview
3+
4+
Juniper has released updates to five known vulnerabilities in Juniper's Junos OS, that are being actively exploited.
5+
6+
## What is the vulnerability?
7+
8+
[**CVE-2023-36844**](https://nvd.nist.gov/vuln/detail/CVE-2023-36844) - CVSS v3 Base Score: ***5.3*** - Juniper Junos OS EX Series PHP External Variable Modification Vulnerability:
9+
- A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.
10+
11+
[**CVE-2023-36845**](https://nvd.nist.gov/vuln/detail/CVE-CVE-2023-36845) - CVSS v3 Base Score: ***9.8*** - Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability:
12+
- A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control an important environment variable.
13+
14+
[**CVE-2023-36846**](https://nvd.nist.gov/vuln/detail/CVE-2023-36846) - CVSS v3 Base Score: ***5.3*** - Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability:
15+
- A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
16+
17+
[**CVE-2023-36847**](https://nvd.nist.gov/vuln/detail/CVE-2023-36847) - CVSS v3 Base Score: ***5.3*** - Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability:
18+
- A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
19+
20+
[**CVE-2023-36851**](https://nvd.nist.gov/vuln/detail/CVE-2023-36851) - CVSS v3 Base Score: ***5.3*** - Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability:
21+
- A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
22+
23+
## What is vulnerable?
24+
25+
The vulnerability affects Juniper Networks Junos OS on SRX Series and EX Series:
26+
27+
- All versions prior to 20.4R3-S9;
28+
- 21.1 version 21.1R1 and later versions;
29+
- 21.2 versions prior to 21.2R3-S7;
30+
- 21.3 versions prior to 21.3R3-S5;
31+
- 21.4 versions prior to 21.4R3-S5;
32+
- 22.1 versions prior to 22.1R3-S4;
33+
- 22.2 versions prior to 22.2R3-S2;
34+
- 22.3 versions prior to 22.3R2-S2, 22.3R3-S1;
35+
- 22.4 versions prior to 22.4R2-S1, 22.4R3;
36+
- 23.2 versions prior to 23.2R1-S1, 23.2R2.
37+
38+
## What has been observed?
39+
40+
There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing.
41+
42+
## Recommendation
43+
44+
The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *one month...* (refer [Patch Management](../guidelines/patch-management.md)):
45+
46+
- The following software releases have been updated to prevent the code execution in CVE-2023-36845 vulnerability:
47+
- 20.4R3-S9, 21.2R3-S7*, 21.3R3-S5, 21.4R3-S5*, 22.1R3-S4, 22.2R3-S2, 22.3R2-S2, 22.3R3-S1, 22.4R2-S1, 22.4R3*, 23.2R1-S1, 23.2R2*, 23.4R1*, and all subsequent releases.
48+
49+
- More updates are to be released to address the remaining vulnerabilities.
50+
51+
#### Recommended Workarounds:
52+
53+
- Disable J-Web, or limit access to only trusted hosts.
54+
55+
## Additional References
56+
57+
- [CISA Adds Six Known Exploited Vulnerabilities to Catalog | CISA](https://www.cisa.gov/news-events/alerts/2023/11/13/cisa-adds-six-known-exploited-vulnerabilities-catalog)
58+
- [2023-08 Out-of-Cycle Security Bulletin: Junos OS: SRX Series and EX Series: Multiple vulnerabilities in J-Web can be combined to allow a preAuth Remote Code Execution (juniper.net)](https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US)
59+
- [Known Exploited Vulnerabilities Catalog | CISA](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=&sort_by=field_date_added)

0 commit comments

Comments
 (0)