A cross site scripting (XSS) vulnerability has been identified in Juniper Networks' Mobility System Software (MSS). The issue results from incorrect validation of user input sent to the MSS web server, and occurs in a file that is part of the network login process.
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2012-1038 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.
No other Juniper Networks products or platforms are affected by this issue.
The vulnerability is fixed in Mobility System Software versions 7.6.3, 7.7.1, and all subsequent releases. This issue is tracked as PR 730242 and is visible on the Customer Support website. KB16765 [juniper.net] - "In which releases are vulnerabilities fixed?" describes which release vulnerabilities are fixed as per our End of Engineering and End of Life support policies.
There are no viable workarounds for this issue.
Acknowledgement The Juniper SIRT thanks Craig Lambert of Dell SecureWorks for handling this vulnerability professionally and reporting it directly to the Juniper SIRT.