In Junos, when a RADIUS authentication server is configured under [system radius-server], an entry is created in /var/etc/pam_radius.conf. An issue was discovered where RADIUS accounting servers configured under [system accounting destination radius] are also propagated to pam_radius.conf. This can cause authentication requests to be sent to the RADIUS accounting server which may allow for unintended successful authentication. If the same RADIUS server is used for both authentication and accounting — a common configuration — the issue is less severe since RADIUS authentication is sent to the intended server despite the duplicate entries. However, if the RADIUS authentication server is later removed from the configuration, the duplicate entry created by configuration of the RADIUS accounting server will remain in pam_radius.conf, also leading to possible unintended authentication success. This issue was found during internal product security testing. Juniper SIRT is not aware of any malicious exploitation of this vulnerability. No other Juniper Networks products or platforms are affected by this issue. This issue has been assigned CVE-2014-6379 .
The following software releases have been updated to resolve this specific issue: Junos OS 11.4R12, 12.1R10, 12.1X44-D35, 12.1X45-D25, 12.1X46-D20, 12.1X47-D10, 12.2R8, 12.2X50-D70, 12.3R6, 13.1R4-S3, 13.1X49-D55, 13.1X50-D30, 13.2R4, 13.2X50-D20, 13.2X51-D26, 13.2X51-D30, 13.2X52-D15, 13.3R2, 14.1R1, and all subsequent releases. This issue is being tracked as PR 947307 and is visible on the Customer Support website. KB16765 [juniper.net] - "In which releases are vulnerabilities fixed?" describes which release vulnerabilities are fixed as per our End of Engineering and End of Life support policies.
No viable workaround exists for this issue. Manual edits to pam_radius.conf will be overwritten when the configuration is committed. Duplicate entries will, however, be cleaned up after upgrading to a fixed release.