Product Affected

All versions of JUNOS Internet software released prior to April 23, 2002.

Problem

Normally, when a program is started, several standard file descriptors are opened, which are assigned to standard input, standard output, and standard error. If a program is started when not all these standard file descriptors are opened, the program might open a file and inadvertently associate it with one of the standard descriptors. The program might then read data from or write data to the file inappropriately. If the file is one that the user would normally not have privileges to open, this might result in an opportunity for privilege escalation. PR/24073.

Solution

The JUNOS kernel has been modified to prevent programs from unintentionally opening arbitrary files using the standard file descriptors.

Install a version of JUNOS Internet software released on or after April 23, 2002.

Severity Assessment

The risks associated with this vulnerability are minimal. A user can exploit the vulnerability only after logging in to the router. Additionally, the vulnerability can be exploited only by using unsupported shell access.