According to its self-reported version number, the remote Junos device could crash when processing a malformed PIM message.  A remote, unauthenticated attacker could exploit this to cause a denial of service.

According to its self-reported version number, the remote Junos device has a denial of service vulnerability.  A timing issue in ttymodem() can cause the Junos kernel to crash whenever the device is accessed remotely (e.g., telnet, SSH).

According to its self-reported version number, the remote Junos device allows inbound SSH traffic even when 'host-inbound-traffic' is not explicitly configured to allow it.

According to its self-reported version number, the remote Junos device has a denial of service vulnerability.  The flowd process may crash when reassembling UDP/IP fragments.

According to its self-reported version number, the remote Junos router has a firewall bypass vulnerability.  This issue is present when log or syslog actions are used along with discard within a firewall filter term deployed on the lo0 loopback interface.  When the receive rate is very high, some packets will bypass the firewall and be received by the routing engine.

According to its self-reported version number, the remote Junos device has a denial of service vulnerability in the J-Web component.
It is possible to send requests to the web server that result in hash collisions, resulting in CPU consumption.

According to its self-reported version number, the remote Junos device has a cross-site scripting vulnerability in the J-Web component.
Unspecified input to index.php can result in cross-site scripting.

According to its self-reported version number, the remote router has a denial of service vulnerability.  Sending a specially crafted broadcast storm of corrupt packets to the data multicast distribution tree port of a Junos router can cause the rpd daemon to hang.  Only routers with PIM enabled in a Rosen MVPN configuration are affected.

According to its self-reported version number, the rpd daemon on remote Junos router may crash when processing malformed IS-IS hello messages.

According to its self-reported version number, the remote Junos device has a privilege escalation vulnerability. When the 'load factory-default' command fails in exclusive edit mode, the user is no longer subject to any command or configuration restrictions.

According to its self-reported version number, the remote Junos router is using an outdated version of OpenSSL. Parsing malformed ASN.1 encoded data can result in memory corruption. This vulnerability can be triggered by attempting to parse untrusted data (e.g., an X.509 certificate).

According to its self-reported version number, the remote Junos router has a denial of service vulnerability.  Receiving an ICMPv6 packet with a corrupted payload within an IPv6 L3VPN can result in a kernel panic.  Only VPNv6 configurations without the 'vrf-table-label' statement in the routing instance configuration are affected.  A remote, unauthenticated attacker could exploit this to crash the router.

According to its self-reported version number, the SYN cookie protection implementation of the remote Junos system has a denial of service vulnerability.  If SYN flood protection is enabled and the SYN cookie protection threshold is exceeded, the server responds to connections with an RST, causing the connection to be closed.

According to its self-reported version and model number, the remote Junos device generates weak cryptographic keys for SSL and SSH.  Due to a lack of entropy in the initial certificate creation, duplicate keys may be created on multiple devices.  An attacker with knowledge of these keys would allow a man in the middle attacker to decrypt SSL or SSH traffic.

Note that self-signed SSL certificates are affected, while SSL certificates signed by a trusted certificate authority are not.

According to its self-reported version and model number, the version of Junos running on the remote host has a memory corruption vulnerability.  When an IPv6 flow session is freed on the Central Point (CP), CP session statistics are updated.  In some situations this update results in memory corruption.  It is not known if code execution is possible.

According to its self-reported version number, the J-Web component of the remote Junos system has a denial of service vulnerability.  A high rate of inbound HTTP connections over an extended period can result in high CPU utilization, even after the connections are terminated.  A remote, unauthenticated attacker could exploit this to cause a denial of service.

According to its self-reported version number, the version of Junos running on the remote host has a denial of service vulnerability.
When MPLS is enabled, receiving a high rate of Pseudo Wire (l2vpn or l2circuit) control words from an adjacent node can cause the routing engine (RE) to become overloaded.  This could result in an RE switchover, or a reboot in single RE environments.

According to its self-reported version number, the version of Junos running on the remote host may grant permissions incorrectly when SSH sessions are authenticated remotely using TACACS+ for authentication and authorization.  Fetched authorizations are stored in a file whose name is based on process ID.  On unclean exits of the SSH client, this file is not deleted, and therefore reused for future login sessions with the same process ID.  This could result in authorizations being applied to the wrong user.

According to its self-reported version number, the version of Junos running on the remote host has multiple denial of service vulnerabilities.  Either of the following issues could result in an rpd crash :

  - Receipt of a malformed non-transitive BGP PATH attribute

  - An established session disconnecting before BGP could     send the first keepalive message

A remote attacker could exploit this to crash the rpd service.

According to its self-reported version number, the J-Web component of the remote Juniper device has a cross-site request forgery vulnerability.  A remote attacker could exploit this by tricking a user into making a maliciously crafted request, resulting in a compromise of the device.

According to its self-reported version number, the version of Junos running on the remote device has a denial of service vulnerability.
Processing a BGP UPDATE containing a corrupted ATTR_SET attribute can result in an rpd crash.

This issue only affects routers configured for BGP running Junos 10.2 or later that do no thave the 'independent-domain' routing option enabled.

A remote, unauthenticated attacker could exploit this to crash the rpd service.

According to its self-reported version number, the version of Junos running on the remote device has a command execution vulnerability.  A flaw in the logical model governing inter-process communications between the management daemon (MGD) and the command-line interpreter (CLI) could result in arbitrary command execution.

A local attacker could exploit this to completely compromise the device.

According to its self-reported version number, the J-Web component of the remote Juniper device has a persistent cross-site scripting vulnerability.  During the authentication process, user controlled input is added to the administrator logs.  When an administrator reviews the logs, that user controlled input is displayed without being sanitized, which could result in a cross-site scripting attack.

According to its self-reported version number, the remote Juniper router has a denial of service vulnerability.  In a Next Generation MVPN scenario, a kernel memory buffer could get corrupted when the router receives a bootstrap or auto-RP message larger than 204 bytes, causing the kernel to crash every time a packet is received.

This issue only occurs in Next-Gen MVPN scenarios that use Ingress Replication as the P-tunnel type and has Auto-RP or Bootstrap as the group-to-RP mapping mechanism.

According to its self-reported version number, the remote Juniper router has a denial of service vulnerability.  Receiving specific route prefix install/delete actions (e.g., a BGP routing update) can cause the router to crash.

This issue only affects MX Series routers with port concetrators based on the Trio chipset.

According to its self-reported version number, the remote Junos device contains a J-Web component that supports the use of weak SSL ciphers (less than 128-bit).

Note: This is considerably easier to exploit if the attacker is on the same physical network.

According to its self-reported version number, the remote device is running a version of Junos with a vulnerable J-Web component.
The 'debug.php' file was inadvertently included with this Junos release.  This file enables unspecified debugging functions and output.

A remote, unauthenticated attacker could exploit this to have unspecified impact on confidentiality and integrity.

The remote device is a Juniper EX Series switch running Junos 11.1R1.
The sfid daemon on the line card may crash repeatedly due to improper parsing of NetBIOS packets.

A remote attacker could exploit this to cause a denial of service.

According to its self-reported version number, the remote Juniper router is running a version of Junos with a denial of service vulnerability.  Sending a specially crafted bootstrap message to the PIM router can cause the rpd routing daemon to crash.
A remote, unauthenticated attacker could exploit this to make the router unresponsive.

According to the vendor's advisory, this issue may be difficult to reliably exploit.

According to its self-reported version number, the remote Juniper router is running a version of Junos that is affected by a denial of service vulnerability.  Sending an ICMP ping with the record-route or timestamp options can crash an L3VPN PE router with either of the following configurations :

  - Point-to-Multipoint LSPs that are used as next hops     in configuration of static routes to customers' networks

  - The 'l3vpn-composite-nexthop' and 'indirect-next-hop'     routing-options are enabled

A remote, unauthenticated attacker could exploit this to crash the router.

According to its self-reported version number, the remote Juniper router is running a version of Junos with a denial of service vulnerability.  Receiving a burst of fragmented ICMP packets can cause the router to become unresponsive until it is rebooted.

A remote, unauthenticated attacker could exploit this to make the router unresponsive.

According to its self-reported version number, the remote Juniper device is running a version of Junos with a security bypass vulnerability.  When the device is configured to perform IPv6 in IPv4 tunneling, policies that apply to the encapsulated datagram are not enforced.

A remote, unauthenticated attacker could exploit this to bypass security restrictions.

According to its self-reported version number, the remote Juniper router has a vulnerable Extended DHCP Relay Agent.  Any interface which has the Extended DHCP Relay Agent enabled intercepts unicast DHCP reply packets.  A remote attacker could exploit this by acting as a malicious DHCP server, sending specially crafted unicast DHCP reply packets through the router.
This could result in traffic being redirected.

According to its self-reported version number, the installation of the Juniper Junos operating system running on the remote host is no longer supported.

Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

The remote host is running Junos, an operating system for Juniper devices.

It is possible to read the Junos version number by logging into the device via SSH, using SNMP, or viewing the web interface.

ID	Name	Severity
62712	Juniper Junos PIM Hello DoS (PSN-2012-10-732)	high
62711	Juniper Junos ttymodem() DoS (PSN-2012-08-699)	high
59997	Juniper Junos host-inbound-traffic Implicit Allow (PSN-2012-07-653)	medium
59996	Juniper Junos UDP/IP DoS (PSN-2012-07-652)	medium
59995	Juniper Junos lo0 Firewall Bypass (PSN-2012-07-651)	high
59994	Juniper Junos J-Web Hash Collision DoS (PSN-2012-07-650)	high
59993	Juniper Junos J-Web XSS (PSN-2012-07-649)	medium
59992	Juniper Junos PIM DoS (PSN-2012-07-648)	medium
59991	Juniper Junos IS-IS hello DoS (PSN-2012-07-647)	medium
59990	Juniper Junos load factory-default Privilege Escalation (PSN-2012-07-646)	medium
59989	Juniper Junos OpenSSL ASN.1 Memory Corruption (PSN-2012-07-645)	high
59988	Juniper Junos ICMPv6 DoS (PSN-2012-07-644)	medium
59987	Juniper Junos SYN Cookie Protection DoS (PSN-2012-07-643)	high
58878	Juniper Junos Key Generation Weakness (PSN-2012-04-549)	medium
58877	Juniper Junos SRX Series for the Data Center Memory Corruption (PSN-2012-04-548)	high
58876	Juniper Junos J-Web CPU Utilization DoS (PSN-2012-04-547)	medium
58875	Juniper Junos MPLS DoS (PSN-2012-04-546)	medium
58874	Juniper Junos SSH TACACS+ Incorrect Permissions (PSN-2012-04-545)	high
57639	Juniper Junos BGP Multiple Remote DoS (PSN-2012-01-475)	medium
57638	Juniper Junos J-Web Component Unspecified CSRF (PSN-2012-01-474)	high
57637	Juniper Junos BGP UPDATE Malformed ATTR_SET Attribute Remote DoS (PSN-2012-01-472)	medium
57636	Juniper Junos MGD-CLI Arbitrary Command Execution (PSN-2011-11-418)	high
56771	Juniper Junos J-Web Administrator Logs XSS (PSN-2011-10-392)	medium
56770	Juniper Junos Next-Gen MVPN Senario Malformed Message Handling Remote DoS (PSN-2011-10-391)	high
56769	Juniper Junos MPC Malformed Route Prefix Remote DoS (PSN-2011-08-327)	medium
55941	Juniper Junos J-Web Weak SSL Ciphers (PSN-2011-01-147)	low
55940	Juniper Junos debug.php J-Web Component Unauthenticated Debug Access (PSN-2011-02-158)	medium
55939	Juniper Junos Multiple sfid Daemon Malformed Packet Remote DoS (PSN-2011-04-241)	medium
55938	Juniper Junos PIM rpd Crafted Boot Message Remote DoS (PSN-2011-07-296)	medium
55937	Juniper Junos ICMP Ping 'composite next-hop' Remote DoS (PSN-2011-07-297)	high
55936	Juniper Junos Fragmented ICMP Packet Handling Remote DoS (PSN-2011-07-298)	medium
55935	Juniper Junos IPv6 over IPv4 Security Policy Bypass (PSN-2011-07-299)	medium
55934	Juniper Junos Extended DHCP Relay Agent Traffic Redirection (PSN-2011-07-300)	low
55933	Juniper Junos Unsupported Version Detection	critical
55932	Junos Version Detection	info

Detections

Analytics

Junos Local Security Checks Family for Nessus

high

high

medium

medium

high

high

medium

medium

medium

medium

high

medium

high

medium

high

medium

medium

high

medium

high

medium

high

medium

high

medium

low

medium

medium

medium

high

medium

medium

low

critical

info