A vulnerability in Junos Space releases before 13.3R1.8 when firewall is disabled, may allow a remote unauthenticated attacker to execute arbitrary commands with root privileges leading to complete compromise of the system and devices managed by Junos Space. A firewall is enabled by default on Junos Space. This vulnerability cannot be exploited remotely when the firewall is enabled.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue has been assigned CVE-2014-3412 .

This issue is fixed in Junos Space 13.3R1.8 and all subsequent releases.

Junos Space releases can be obtained from:
http://www.juniper.net/support/downloads/?p=space#sw

Enable firewall on Junos Space and limit access only from trusted hosts.

• KB16613: Overview of the Juniper Networks SIRT Monthly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team